CVE WATCH / VULNERABILITY DETAIL
CVE-2026-12424
HIGHCVSS 7.2NVD feed
Published 11 November 2026 · tracked since 12 November 2026
Description
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-123480 MEDIUM 6.5
- CVE-2026-118414 MEDIUM 5.4
- CVE-2026-118413 MEDIUM 5.4
- CVE-2026-118411 HIGH 8.8
- CVE-2026-105154 MEDIUM 6.1
- CVE-2026-105153 HIGH 7.7
- CVE-2026-125451 MEDIUM 6.5
- CVE-2026-119615 HIGH 8.8
- CVE-2026-119097 MEDIUM 6.4
- CVE-2026-103883 HIGH 8.8