CVE-2026-3652: ARForms WordPress Plugin Stored XSS in Partial Form Entries

Technical summary

CVE-2026-3652 is a Stored Cross-Site Scripting (XSS) vulnerability in the ARForms WordPress plugin stemming from improper input sanitization and output escaping in the `arf_save_incomplete_form_data` AJAX action. Unauthenticated attackers can submit malicious JavaScript payloads via the `value` parameter, which are stored in the database without adequate filtering. When an authenticated administrator accesses the "Partial Filled Form Entries" dashboard page, the stored payload executes in the administrator's browser context with full privileges. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

This vulnerability enables credential theft, unauthorized administrative actions, and potential site compromise. An attacker can persistently inject malicious scripts that execute whenever any administrator reviews partial form entries, creating a reliable mechanism for lateral movement or privilege escalation. In multi-user WordPress environments, this could affect numerous administrators. The impact extends beyond the plugin itself—attackers could modify site content, install backdoors, or exfiltrate sensitive user data collected through forms.

Affected systems

WordPress installations running the ARForms plugin in versions 7.1.3 and earlier are affected. The vulnerability is accessible to unauthenticated users via the AJAX endpoint, making it exploitable from the internet without account access. Any WordPress site using this plugin for form management is at risk.

Exploitability

This vulnerability has high exploitability. It requires no authentication, no special user interaction beyond normal administrator workflow (viewing the dashboard), and no browser-specific exploitation techniques. An attacker simply submits a malicious payload through the plugin's AJAX action; no additional complexity or race conditions are needed. The network vector is unrestricted, and the attack is trivial to execute and chain with other attacks.

Remediation

Update the ARForms plugin to a patched version beyond 7.1.3. Verify with the plugin vendor's security advisory for the specific version containing the fix. As an interim measure, if an update is not immediately available, consider disabling the ARForms plugin or restricting access to the WordPress dashboard through network controls (IP allowlisting, VPN requirement) until patching is possible.

Patch guidance

Check the ARForms plugin repository or vendor advisory for a version released after June 24, 2026 that addresses CVE-2026-3652. Update via the WordPress plugin dashboard or command line (`wp plugin update arforms`). After updating, verify the plugin version reflects the patched release and conduct a brief functional test of form submission and admin dashboard access to ensure no regressions.

Detection guidance

Monitor server logs for AJAX requests to `wp-admin/admin-ajax.php` with the `action=arf_save_incomplete_form_data` parameter. Look for requests containing script tags, event handlers (onclick, onerror, etc.), or other XSS payloads in the `value` parameter. Audit database entries in the table(s) storing partial form data for suspicious JavaScript or HTML. Use WordPress security plugins with XSS detection or enable Web Application Firewall rules to block common XSS patterns in AJAX requests to this endpoint.

Why prioritize this

While not yet listed on the KEV catalog, this vulnerability merits immediate priority due to its high CVSS score (7.2), unauthenticated attack vector, and broad impact on administrators. The stored nature of the XSS means the attack persists and affects all admin users repeatedly. Organizations running ARForms should patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects an unauthenticated network attack with low complexity, cross-site scope, and dual confidentiality and integrity impact. Although availability is not directly impacted, the ability for attackers to persistently compromise administrator sessions elevates risk significantly in multi-user environments. The lack of authentication and the guaranteed execution whenever an admin accesses the affected page push this into high-priority territory despite not reaching critical threshold.

Frequently asked questions