CVE Tools
Track your stack

Arforms

14 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Arforms, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Arforms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Arforms CVEs per month
MonthCVEs
2024-110
2024-122
2025-010
2025-020
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-061
2026-070
2026-080
2026-090
2026-101

Severity

How the 14 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical17%
  • High964%
  • Medium429%

Latest CVEs

The 14 most recently published vulnerabilities affecting Arforms.

  1. CVE-2026-39766WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability7.1
  2. CVE-2026-57338WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1
  3. CVE-2024-10504ARForms Builder < 1.7.1 - Unauthenticated Stored XSS5.4
  4. CVE-2024-54217WordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability5.4
  5. CVE-2024-54216WordPress ARForms plugin < 7.0.2 - Path Traversal vulnerability7.7
  6. CVE-2024-0427Arforms < 6.4.1 - Reflected XSS6.3
  7. CVE-2024-32703WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerability7.7
  8. CVE-2024-32704WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerability7.1
  9. CVE-2024-32705WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerability7.1
  10. CVE-2024-4621ArForms < 6.6 - Admin+ Stored XSS4.8
  11. CVE-2024-4620ArForms < 6.6 - Unauthenticated RCE9.8
  12. CVE-2024-32702WordPress ARForms plugin <= 6.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1
  13. CVE-2024-32706WordPress ARForms plugin <= 6.4 - Subscriber+ SQL Injection vulnerability8.5
  14. CVE-2019-16902In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.7.5

Product grouping is registry-driven, with AI assist and human review. How it works