The ARForms plugin for WordPress under version 7.1.2 permits an unauthenticated attacker to inject malicious scripts into form pages, resulting in a classic client‑side Cross Site Scripting flaw. Because authentication is not required, any visitor can trigger the script, enabling the attacker to deface the site, steal user cookies or other session data, or load additional malware. The vulnerability is rooted in insufficient output encoding of user‑supplied data.

Affected software is the ARForms WordPress plugin distributed by reputeinfosystems. Versions 7.1.2 and all earlier releases are vulnerable. The plugin operates as a form building and data collection component on WordPress sites.

The flaw carries a CVSS score of 7.1, indicating moderate to high potential for damage. The EPSS score is 0.25%, and the vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed widespread exploitation has been reported. The attack vector is inferred to be web‑based and unauthenticated XSS via form pages, and successful exploitation could allow session hijacking, content injection, or phishing attacks against site users.