Contact Form, Survey, Quiz & Popup Form Builder – ARForms

Contact Form, Survey, Quiz & Popup Form Builder – ARForms has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 11 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2024 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (45%). Other recurring categories include Missing Authorization, Code Injection.

Every one of the 11 issues recorded for Contact Form, Survey, Quiz & Popup Form Builder – ARForms has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, most of them (3) reported by beluga.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Contact Form, Survey, Quiz & Popup Form Builder – ARForms vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-13784

Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

11 records


2026-08-15 20:14	Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection Contact Form <= 1.8.5	`CVE-2024-13784`	9.8 Critical	Krzysztof Zając	Yes
2026-03-20 15:21	Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.4 - Unauthenticated Blind Arbitrary Shortcode Execution Contact Form <= 1.7.4	`CVE-2024-13785`	5.6 Medium	Krzysztof Zając	Yes
2025-01-06 00:00	Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting Contact Form <= 1.7.0	`CVE-2024-10504`	7.2 High	Malek Althubiany	Yes
2024-12-05 00:00	ARForms Form Builder <= 1.7.1 - HTML Injection Contact Form <= 1.7.1	`CVE-2024-54223`	6.5 Medium	Pritam Dash	Yes
2024-07-09 00:00	ARForms Form Builder <= 1.6.7 - Reflected Cross-Site Scripting Contact Form <= 1.6.7	`CVE-2024-37920`	6.1 Medium	beluga	Yes
2024-04-25 00:00	ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion Contact Form <= 1.6.4	`CVE-2024-1945`	7.1 High	Lucio Sá	Yes
2024-04-05 00:00	ARForms Form Builder <= 1.6.1 - Cross-Site Request Forgery Contact Form <= 1.6.1	`CVE-2024-31272`	4.3 Medium	beluga	Yes
2024-04-05 00:00	ARForms Form Builder <= 1.6.1 - Missing Authorization Contact Form <= 1.6.1	`CVE-2024-31270`	4.3 Medium	beluga	Yes
2024-01-03 00:00	ARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url Contact Form <= 1.5.8	`CVE-2023-6828`	7.2 High	drop	Yes
2022-11-23 00:00	ARForms Form Builder <= 1.5.6 - Unauthenticated Cross-Site Scripting Contact Form <= 1.5.6	`CVE-2022-45838`	7.2 High	thiennv	Yes

Showing 1–10 of 11 reports