Nex Forms Ultimate Forms Plugin For Wordpress

WordPress plugin · nex-forms-ultimate-forms-plugin-for-wordpress · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Nex Forms Ultimate Forms Plugin For Wordpress on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header CVE.org	<=9.3.2	unfixed	CVE-2026-96767	Oct 29, 2026
HIGH CVSS 8.1	NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CVE.org	<=9.2.3	unfixed	CVE-2026-15450	Aug 1, 2026
HIGH CVSS 7.2	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter CVE.org	<=9.2.2	unfixed	CVE-2026-13040	Jul 3, 2026
HIGH CVSS 7.2	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter CVE.org	<=9.2.2	unfixed	CVE-2026-12142	Jul 1, 2026
MEDIUM CVSS 4.9	NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter CVE.org	<=9.3.0	unfixed	CVE-2026-75961	Sep 18, 2026
MEDIUM CVSS 4.9	NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter CVE.org	<=9.2.4	unfixed	CVE-2026-15602	Aug 16, 2026
MEDIUM CVSS 5.3	NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action CVE.org	<=9.2.2	unfixed	CVE-2026-9017	Jul 11, 2026
MEDIUM CVSS 5.3	NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class CVE.org	<=9.2.2	unfixed	CVE-2026-12404	Jun 27, 2026
MEDIUM CVSS 4.9	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter CVE.org	<=9.1.12	unfixed	CVE-2026-7046	May 15, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.