---
id: "CVE-2026-12424"
page: "https://infrastack.ai/live/CVE-2026-12424"
kind: "vulnerability"
aliases: ["CVE-2026-12424"]
title: "ARforms WordPress plugin: unauthenticated Referer header stores script that runs for visitors"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ARforms", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["arforms", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T08:17:18+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:27:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12424", "first_seen_at": "2026-11-11T08:26:05+00:00"}]
exploit_sources: []
---

# ARforms WordPress plugin: unauthenticated Referer header stores script that runs for visitors

Link for people: https://infrastack.ai/live/CVE-2026-12424 (this .md is for agents)

The ARforms plugin for WordPress stores attacker-supplied content from the Referer header through an unauthenticated AJAX handler, without sanitizing or escaping it. When a user opens a page containing the stored payload, the attacker's JavaScript runs in that user's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ARforms affected range not listed fixed no fixed version listed

## How to check

- Check whether the ARforms plugin is installed and its version in the WordPress admin under Plugins.
- Look for the `arf_save_incomplete_form_data` handler in the plugin's code.

## Fix

- ARforms plugin: a fixed version is unknown; the sources say all versions up to and including `7.2.4` are affected.

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12424

## Documents

- [advisory] Python security-announce: [Security-announce][CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie https://mail.python.org/archives/list/security-announce@python.org/message/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/

## From the sources

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The arf_save_incomplete_form_data() AJAX handler is registered with wp_ajax_nopriv_, meaning unauthenticated attackers can store a malicious payload by submitting a partial form entry with a forged Referer header, with no authentication required at any step.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_