ARforms

ARforms has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; 13 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 10.0 out of 10. Severity breakdown: 1 critical and 7 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (40%). Other recurring categories include Missing Authorization, Path Traversal.

13 of the records (87%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2024.

8 independent researchers contributed these findings, most of them (7) reported by Dave Jong.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage87%

Open

Fixed

Get automatic notifications for all ARforms vulnerabilities before they are exploited.

Most severe open issueCVSS 7.7CVE-2024-54216

ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read

Read the full analysis

Vulnerability Records

15 records


2026-07-22 18:42	ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values ARforms <= 7.2.1	`CVE-2026-12421`	7.2 High	Luc Huynh from Noventiq RedTeam	Yes
2026-06-29 00:00	ARforms <= 7.1.2 - Reflected Cross-Site Scripting ARforms <= 7.1.2	`CVE-2026-57338`	6.1 Medium	dutafi	Yes
2026-06-23 13:57	ARForms <= 7.1.1 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter ARforms <= 7.1.1	`CVE-2026-3652`	7.2 High	h0xilo	Yes
2024-12-02 00:00	ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read ARforms <= 6.4.1	`CVE-2024-54216`	7.7 High	Dave Jong	No
2024-12-02 00:00	ARForms <= 6.4.1 - Missing Authorization to Plugin Settings Change ARforms <= 6.4.1	`CVE-2024-54217`	5.4 Medium	Dave Jong	No
2024-05-22 00:00	ARForms - Premium WordPress Form Builder <= 6.4.0 - Reflected Cross-Site Scripting ARforms <= 6.4.0	`CVE-2024-0427`	6.1 Medium	Thura Moe Myint (mgthuramoemyint)	Yes
2024-05-17 00:00	ARForms Form Builder <= 6.5 - Unauthenticated Arbitrary File Upload ARforms <= 6.5	`CVE-2024-4620`	10.0 Critical	Thura Moe Myint (mgthuramoemyint)	Yes
2024-05-17 00:00	ARforms <= 6.5 - Authenticated (Admin+) Stored Cross-Site Scripting ARforms <= 6.5	`CVE-2024-4621`	4.4 Medium	Bob Matyas	Yes
2024-04-22 00:00	ARForms <= 6.4 - Missing Authorization to Arbitrary File Deletion ARforms <= 6.4	`CVE-2024-32703`	8.1 High	Dave Jong	Yes
2024-04-22 00:00	ARForms <= 6.4 - Missing Authorization to Arbitrary Option Deletion ARforms <= 6.4	`CVE-2024-32704`	4.3 Medium	Dave Jong	Yes

Showing 1–10 of 15 reports