{"id":"CVE-2026-12424","kind":"vulnerability","aliases":["CVE-2026-12424"],"related":[],"title":"ARforms WordPress plugin: unauthenticated Referer header stores script that runs for visitors","description":"The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication required at any step.","summary":"The ARforms plugin for WordPress stores attacker-supplied content from the Referer header through an unauthenticated AJAX handler, without sanitizing or escaping it. When a user opens a page containing the stored payload, the attacker's JavaScript runs in that user's browser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ARforms","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["arforms","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the ARforms plugin is installed and its version in the WordPress admin under Plugins.\n- Look for the `arf_save_incomplete_form_data` handler in the plugin's code.","fix":"- ARforms plugin: a fixed version is unknown; the sources say all versions up to and including `7.2.4` are affected.","status":"open","published_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:51+00:00","updated_at":"2026-11-11T08:27:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T08:27:51Z","model":"claude-haiku-5-5","output":{"fix":"- ARforms plugin: a fixed version is unknown; the sources say all versions up to and including `7.2.4` are affected.","reach":"internet","title":"ARforms WordPress plugin: unauthenticated Referer header stores script that runs for visitors","impact":"medium","summary":"The ARforms plugin for WordPress stores attacker-supplied content from the Referer header through an unauthenticated AJAX handler, without sanitizing or escaping it. When a user opens a page containing the stored payload, the attacker's JavaScript runs in that user's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","arforms","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the site, stealing sessions.","analyst_note":"Find the fixed ARforms version and the vendor advisory; the sources give only the affected range up to 7.2.4.","how_to_check":"- Check whether the ARforms plugin is installed and its version in the WordPress admin under Plugins.\n- Look for the `arf_save_incomplete_form_data` handler in the plugin's code.","plain_action":"","product_name":"ARforms","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ARforms plugin for WordPress at version 7.2.4 or earlier are exposed, since the flawed AJAX handler accepts requests without logging in. Sites without this plugin are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4723,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-12424':15A,18A '-2026':14A,17A '7.2.4':93C 'access':122C 'ajax':43B,132C,138C 'arbitrari':111C 'arf':127C 'arform':1A,20B,27B,71C 'arforms':19A 'attack':33B,61B,108C,142C 'attacker-suppli':32B 'authent':161C 'browser':69B 'contain':56B 'content':35B 'cross':80C 'cross-sit':79C 'cve':13A,16A 'data':131C 'due':94C 'entri':153C 'escap':48B,101C 'execut':118C 'forg':156C 'form':130C,152C 'handler':44B,133C 'header':6A,39B,85C,158C 'host':24B 'includ':92C 'incomplet':129C 'inject':110C,124C 'input':97C 'insuffici':96C 'javascript':63B 'make':103C 'malici':146C 'mean':140C 'nopriv':139C 'open':53B 'output':100C 'packag':21B 'page':55B,115C,125C 'partial':151C 'payload':59B,147C 'plugin':3A,28B,72C 'possibl':105C 'refer':5A,38B,84C,157C 'regist':135C 'requir':162C 'run':10A,64B 'sanit':46B,98C 'save':128C 'script':8A,82C,113C 'self':23B 'self-host':22B 'site':81C 'step':165C 'store':7A,31B,58B,78C,144C 'submit':149C 'suppli':34B 'unauthent':4A,42B,107C,141C 'user':52B,67B,121C 'version':88C 'via':83C 'visitor':12A 'vulner':76C 'web':112C 'whenev':119C 'without':45B 'wordpress':2A,25B,30B,74C 'wp':137C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ARforms plugin for WordPress at version 7.2.4 or earlier are exposed, since the flawed AJAX handler accepts requests without logging in. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["arforms"],"ptokens":["arforms"],"labels":["arforms","high","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-12424':15A,18A '-2026':14A,17A 'arform':1A 'arforms':19A 'cve':13A,16A 'header':6A 'plugin':3A 'refer':5A 'run':10A 'script':8A 'store':7A 'unauthent':4A 'visitor':12A 'wordpress':2A","search_b":"'ajax':43B 'arform':20B,27B 'attack':33B,61B 'attacker-suppli':32B 'browser':69B 'contain':56B 'content':35B 'escap':48B 'handler':44B 'header':39B 'host':24B 'javascript':63B 'open':53B 'packag':21B 'page':55B 'payload':59B 'plugin':28B 'refer':38B 'run':64B 'sanit':46B 'self':23B 'self-host':22B 'store':31B,58B 'suppli':34B 'unauthent':42B 'user':52B,67B 'without':45B 'wordpress':25B,30B","search_c":"'7.2.4':93C 'access':122C 'ajax':132C,138C 'arbitrari':111C 'arf':127C 'arform':71C 'attack':108C,142C 'authent':161C 'cross':80C 'cross-sit':79C 'data':131C 'due':94C 'entri':153C 'escap':101C 'execut':118C 'forg':156C 'form':130C,152C 'handler':133C 'header':85C,158C 'includ':92C 'incomplet':129C 'inject':110C,124C 'input':97C 'insuffici':96C 'make':103C 'malici':146C 'mean':140C 'nopriv':139C 'output':100C 'page':115C,125C 'partial':151C 'payload':147C 'plugin':72C 'possibl':105C 'refer':84C,157C 'regist':135C 'requir':162C 'sanit':98C 'save':128C 'script':82C,113C 'site':81C 'step':165C 'store':78C,144C 'submit':149C 'unauthent':107C,141C 'user':121C 'version':88C 'via':83C 'vulner':76C 'web':112C 'whenev':119C 'wordpress':74C 'wp':137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-07T19:58:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12424","severity":null,"published_at":"2026-11-11T08:17:18+00:00","modified_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[{"id":107842,"url":"https://mail.python.org/archives/list/security-announce@python.org/message/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","title":"Python security-announce: [Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie","kind":"advisory","source":"advisory","publisher":null,"text":"[Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie\n\nThere is a MEDIUM severity vulnerability affecting CPython. http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-124249 * https://github.com/python/cpython/pull/161570","published_at":"2026-11-07T19:58:34+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}