ARForms for WordPress is vulnerable to a stored XSS flaw that can be triggered by supplying arbitrary content in the "value" parameter of the arf_save_incomplete_form_data AJAX action. The input is inadequately sanitized and not properly escaped, permitting attackers to embed malicious scripts that run whenever an administrator views the Partial Filled Form Entries page. By executing code in this privileged context, an attacker can hijack admin sessions, steal sensitive data, or perform further attacks against the site. The weakness is a classic input validation error indexed as CWE‑79.

The vulnerability applies to all installations of the ARForms plugin version 7.1.3 and earlier. Any WordPress site that has not upgraded beyond this release is exposed, regardless of the underlying operating system or PHP configuration.

The CVSS score of 7.2 indicates a high severity issue that requires immediate attention. Because the AJAX endpoint is publicly accessible, an unauthenticated attacker can inject a payload with no additional permissions, making the flaw easy to exploit. Although EPSS is not available, the lack of KEV listing does not reduce the urgency; the vulnerability has a clearly defined attack path and can be automated by an attacker simply by visiting the site or sending crafted requests.