CVE-2026-12427

{
  "etk_id": "ETK-2026-4159",
  "cve_id": "CVE-2026-12427",
  "display_id": "CVE-2026-12427",
  "ghsa_id": "GHSA-269c-5hmm-363q",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in ARforms for WordPress",
  "summary": "ARforms for WordPress versions 7.2.4 and earlier mishandle user-controlled description content, allowing persistent script injection. An unauthenticated attacker may cause code to run in the browser of someone who views affected content or an affected entry detail, including an administrator.",
  "mitigation": "Update ARforms to a release later than 7.2.4. Until updating, limit public access to affected form submissions and restrict access to entry-detail pages.",
  "vendor": null,
  "product": "ARforms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 7.2.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ARforms",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.01868595,
  "t0_at": "2026-11-11T07:26:40.857000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T11:07:21.320174+00:00",
      "days": 0.15324610155092594,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T07:26:40.857000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T07:26:40.857000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T07:26:40.857000+00:00",
      "url": "https://github.com/advisories/GHSA-269c-5hmm-363q"
    }
  }
}