The ARForms plugin for WordPress suffers from a stored Cross-Site Scripting vulnerability (CWE-79) in all versions up to and including 7.1.3. The vulnerability is triggered through the 'value' parameter of the 'arf_save_incomplete_form_data' AJAX action, which does not properly sanitize or escape input. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of an administrator's browser when viewing the Partial Filled Form Entries page, potentially leading to session hijacking or other attacks. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

An unauthenticated attacker can inject and store malicious scripts that execute when an administrator accesses a specific page in the ARForms dashboard. This can lead to unauthorized disclosure of sensitive information or manipulation of administrative functions. The vulnerability affects confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the ARForms dashboard to trusted administrators only and consider disabling or limiting the use of the affected AJAX action if possible.