Atomic Edge analysis of CVE-2026-3652 (metadata-based): This vulnerability allows unauthenticated stored cross-site scripting (XSS) in the ARForms plugin for WordPress, versions 7.1.3 and earlier. The flaw exists in the ‘value’ parameter of the ‘arf_save_incomplete_form_data’ AJAX action. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator views the ‘Partial Filled Form Entries’ page in the ARForms dashboard. The CVSS score is 7.2 (High) with a network attack vector, low complexity, no privileges required, and no user interaction.
The root cause is insufficient input sanitization and output escaping on the ‘value’ parameter passed to the ‘arf_save_incomplete_form_data’ AJAX handler. Based on the CWE-79 classification, this is a classic stored XSS vulnerability. Atomic Edge analysis infers that the plugin likely saves this parameter directly to the database without calling WordPress sanitization functions like ‘sanitize_text_field’ or ‘wp_kses_post’ on input. Similarly, when rendering the ‘Partial Filled Form Entries’ admin page, the plugin probably outputs the stored value without using ‘esc_html’ or ‘wp_kses’ for escaping. These conclusions are inferred from the CWE and description, as no code diff is available.
Exploitation requires sending a POST request to ‘/wp-admin/admin-ajax.php’ with the action parameter set to ‘arf_save_incomplete_form_data’ and the ‘value’ parameter containing a JavaScript payload. The attacker does not need authentication or a nonce. A typical payload would include script tags or event handlers, such as alert(‘XSS’). The AJAX request triggers the handler, which stores the payload. When an administrator later loads the ‘Partial Filled Form Entries’ page, the stored script executes in their browser session.
Remediation requires implementing proper input sanitization and output escaping for the ‘value’ parameter. On input, the plugin should use ‘sanitize_text_field’ or ‘sanitize_textarea_field’ depending on expected data. On output in the admin dashboard, the plugin must use ‘esc_html’ or ‘wp_kses’ to prevent HTML execution. A nonce check should also be added to the AJAX handler to prevent unauthenticated submissions. Since no patched version exists, site administrators should disable the ARForms plugin or use a web application firewall to block exploitation attempts.
If exploited, an attacker can execute arbitrary JavaScript in the context of the WordPress admin dashboard. This enables actions such as creating new admin users, modifying plugin settings, injecting backdoors, or exfiltrating sensitive data. Although the CVSS confidentiality and integrity impact are rated low, the attack can escalate to full site compromise when combined with other techniques like privilege escalation via WordPress admin functions.
