WordPress plugin security 11 Nov: ARForms, Ninja Forms add-on, Joinchat

If your WordPress site uses the ARForms form builder or the Ninja Forms File Uploads add-on, update it today. Patchstack, which listed these holes on 10 and 11 November 2026, rates both as high priority and says attacks need no login. Joinchat, the WhatsApp chat button, and 11 other plugins also have fixes out. Check the list below and update each one you have.

Which plugins need urgent attention?

• ARForms 7.2.4 and older: anyone can upload a file that can then run as code on the site (CVE-2026-111190). The same versions also have two holes that let an outsider save harmful script in the site (CVE-2026-12424 and CVE-2026-12427). All three are fixed in 7.3. Patchstack expects these to be used in mass attacks.
• Ninja Forms File Uploads add-on 3.3.36 and older: anyone can delete files on the site without logging in (CVE-2026-126537). Removing the wrong file can break a site or open it up to a takeover. Fixed in 3.3.37.

Which other plugins have fixes?

Patchstack rates all of these as low priority. The Download Manager holes let outsiders reach a function that should be locked. Forminator, Schema & Structured Data and Supsystic can show visitors some data they should not see. The Joinchat hole only works when someone opens a crafted link, but WhatsApp chat buttons are on a lot of Malaysian business sites, so it is worth a quick check. If you updated Elementor and Forminator after our 4 November post, you already have the fixed versions.

What to do

1. Back up the site and its database before you start, or ask whoever manages your hosting to do it.
2. Log in to WordPress and go to Plugins, then Installed Plugins. Compare the version of each plugin with the lists above.
3. Update ARForms and Ninja Forms File Uploads first. The Ninja Forms add-on is a paid plugin, and paid plugins often need a valid licence key before the dashboard offers the update. If no update shows, get the new version from the developer's own site.
4. Then update the rest one at a time. After each one, open your home page and send a test through your contact form.
5. If a plugin has no update you can install, switch it off and delete it until you can.
6. If ARForms or Ninja Forms File Uploads was out of date on your site, check Users for administrator accounts nobody recognises. Ask your developer or host to look for new or missing files in the site folders, especially under wp-content/uploads.
7. Do the same on any staging or test copy of the site.

Many business sites in Malaysia are built and maintained by an outside web designer. If that is your case, forward this post to them today and ask them to confirm when the updates are done.

How SyncTech can help

If nobody looks after plugin updates for your site, our WordPress care plan for business websites covers backups, plugin updates and a check of the site after each update.

Source and credit

We are sharing this news from Patchstack and the WordPress.org plugin directory. This summary is written by Synctech in our own words.

• WordPress ARForms plugin 7.2.4 and older, unauthenticated arbitrary file upload (CVE-2026-111190), Patchstack, 10 November 2026: https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-2-4-unauthenticated-arbitrary-file-upload-to-remote-code-execution-via-x-filename-header-vulnerability
• WordPress ARForms plugin 7.2.4 and older, unauthenticated stored XSS via Referer header (CVE-2026-12424), Patchstack, 10 November 2026: https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-2-4-unauthenticated-stored-cross-site-scripting-via-referer-header-vulnerability
• WordPress ARForms plugin 7.2.4 and older, unauthenticated stored XSS via description (CVE-2026-12427), Patchstack, 10 November 2026: https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-2-4-unauthenticated-stored-cross-site-scripting-via-description-parameter-vulnerability
• WordPress Ninja Forms File Uploads plugin 3.3.36 and older, unauthenticated arbitrary file deletion (CVE-2026-126537), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/ninja-forms-uploads/vulnerability/wordpress-ninja-forms-file-uploads-plugin-3-3-36-unauthenticated-arbitrary-file-deletion-vulnerability
• WordPress Download Manager plugin 4.0.0 to 7.6.1, missing authorization (CVE-2026-110949), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/download-manager/vulnerability/wordpress-download-manager-plugin-4-0-0-7-6-1-unauthenticated-missing-authorization-vulnerability
• WordPress Download Manager plugin below 3.3.73, missing authorization (CVE-2026-110949), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-73-unauthenticated-missing-authorization-vulnerability
• WordPress Joinchat plugin 6.3.1 and older, reflected XSS (CVE-2026-15785), Patchstack, 10 November 2026: https://patchstack.com/database/wordpress/plugin/creame-whatsapp-me/vulnerability/wordpress-joinchat-enhanced-click-to-chat-plugin-6-3-1-reflected-cross-site-scripting-vulnerability
• WordPress Elementor Website Builder plugin below 4.3.6, contributor stored XSS (CVE-2026-104718), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-6-contributor-stored-xss-vulnerability
• WordPress Forminator plugin below 1.58.4, data exposure (CVE-2026-111597), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-forms-plugin-1-58-4-unauthenticated-disclosure-of-post-payment-redirect-url-and-thank-you-message-vulnerability
• WordPress Schema & Structured Data for WP & AMP plugin below 1.70, broken access control (CVE-2026-119034), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/schema-and-structured-data-for-wp/vulnerability/wordpress-schema-structured-data-for-wp-amp-plugin-1-70-unauthenticated-non-public-comment-disclosure-vulnerability
• WordPress Smush plugin below 4.3.6, IDOR (CVE-2026-118241), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/wp-smushit/vulnerability/wordpress-smush-plugin-4-3-6-author-optimization-and-restoration-of-others-attachments-vulnerability
• WordPress AnyWhere Elementor plugin below 1.3.1, data exposure (CVE-2026-117524), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-dynific-addons-for-elementor-formerly-anywhere-elementor-plugin-1-3-1-contributor-arbitrary-post-content-disclosure-vulnerability
• WordPress Code Snippets plugin below 4.1.0, broken access control (CVE-2026-106468), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/code-snippets/vulnerability/wordpress-code-snippets-plugin-4-1-0-admin-network-scoped-snippet-injection-vulnerability
• WordPress WPIDE plugin 3.6.4 and older, CSRF (CVE-2026-124251), Patchstack, 10 November 2026: https://patchstack.com/database/wordpress/plugin/wpide/vulnerability/wordpress-wpide-file-manager-code-editor-plugin-3-6-4-cross-site-request-forgery-csrf-vulnerability
• WordPress Data Tables Generator by Supsystic plugin below 1.15.8, IDOR (CVE-2026-110016), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/data-tables-generator-by-supsystic/vulnerability/wordpress-data-tables-generator-by-supsystic-plugin-1-15-8-unauthenticated-table-content-disclosure-vulnerability
• WordPress WP Directory Kit plugin below 1.6.3, SQL injection (CVE-2026-118420), Patchstack, 11 November 2026: https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-6-3-listing-admin-sql-injection-vulnerability
• Plugin pages and current versions, WordPress.org Plugin Directory: https://wordpress.org/plugins/

Retrieved 11 November 2026. WordPress, ARForms, Ninja Forms, Joinchat, Elementor and the other plugin names are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.