Threats tagged 'ghsa-hg3f-5929-jv7q'

The ARforms WordPress plugin up to version 7.2.4 is vulnerable to stored cross-site scripting (XSS) via the Referer header. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The flaw exists due to insufficient input sanitization and output escaping in the plugin's AJAX handler for saving incomplete form data, which is accessible without authentication.