Vulnerabilities

TI-2024-09730 CVE-2024-10504 · GHSA-q4jv-p3r8-p9rx

ARForms Builder < 1.7.1 - Unauthenticated Stored XSS

MEDIUM 58

The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Si…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00344 Published 2025-05-15 Fixed in 1.7.1 CWE-79

TI-2024-36306 CVE-2024-54217 · GHSA-hp59-f5w9-w867

WordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability

LOW 25

Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00451 Published 2024-12-09 No fix listed CWE-862

TI-2024-36305 CVE-2024-54216 · GHSA-2c82-59ww-vx6g

WordPress ARForms plugin < 7.0.2 - Path Traversal vulnerability

LOW 34

Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00551 Published 2024-12-06 Fixed in 7.0.2 CWE-35

TI-2024-00389 CVE-2024-0427 · GHSA-7crc-mm89-h2v3

Arforms < 6.4.1 - Reflected XSS

MEDIUM 61

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00358 Published 2024-06-12 Fixed in 6.4.1 CWE-79

TI-2024-21583 CVE-2024-32703 · GHSA-77xx-hpqw-prh9

WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerability

LOW 36

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00577 Published 2024-06-09 No fix listed CWE-22

TI-2024-21584 CVE-2024-32704 · GHSA-443p-ggjw-7w6x

WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerability

LOW 31

Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00335 Published 2024-06-09 No fix listed CWE-862

TI-2024-21585 CVE-2024-32705 · GHSA-227p-7qgj-96v9

WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerability

LOW 38

Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00382 Published 2024-06-09 No fix listed CWE-862

TI-2024-04301 CVE-2024-4621 · GHSA-99x5-vp7j-568g

ArForms < 6.6 - Admin+ Stored XSS

MEDIUM 55

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00351 Published 2024-06-07 Fixed in 6.6 CWE-79

TI-2024-04300 CVE-2024-4620 · GHSA-3444-vgqg-w2gc

ArForms < 6.6 - Unauthenticated RCE

HIGH 82

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03345 Published 2024-06-07 Fixed in 6.6

TI-2024-21582 CVE-2024-32702 · GHSA-w24g-q24f-q94h

WordPress ARForms plugin <= 6.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00354 Published 2024-04-24 No fix listed CWE-79

TI-2024-21586 CVE-2024-32706 · GHSA-6vwq-6fjp-322j

WordPress ARForms plugin <= 6.4 - Subscriber+ SQL Injection vulnerability

MEDIUM 41

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00561 Published 2024-04-24 No fix listed CWE-89

TI-2019-12605 CVE-2019-16902 · GHSA-wmr8-fmmf-mpmw

In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows…

MEDIUM 45

In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.09726 Published 2019-09-27 No fix listed CWE-22

Vulnerabilities

Filters