NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS

NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wpajaxnoprivsubmitnexform handler for form submissions. Array-type field values are processed through restsanitizearray, which only reindexes th...

nex-forms_SQL-Injection-CVE-2023-2114

nex-formsSQL-Injection CVE-2023-2114 https://vulners.com/cve/CVE-2023-2114 https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d Quick Review about the SQL-Injection in the NEX-Forms Plugin for WordPress Uploaded exploit Note that this uploaded exploit code isnt for this particula...

CVE-2026-96767

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

EUVD-2026-112745

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96767

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.3.2 . The root cause is insufficient input sanitization and output escaping related to the 'type' parameter . This flaw allows unauthenticated attackers to ...

CVE-2026-96767 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96767 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin NEX-Forms versions = 9.3.2...

WordPress NEX-Forms cross-site scripting vulnerability

WordPress NEX-Forms versions 9.3.2 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping of the ‘type’ parameter, potentially enabling stored cross-site scripting attacks. Unauthenticated attackers can inject arbitrary w...

PT-2026-132098

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96767: webaways NEX-Forms – Ultimate Forms Plugin for WordPress: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting…

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-106166

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

WordPress NEX-Forms plugin 9.2.1-9.3.0 - Unauthenticated Arbitrary Form Entry Modification vulnerability

Unauthenticated Arbitrary Form Entry Modification vulnerability discovered by Farid Narimanov in WordPress Plugin NEX-Forms versions 9.2.1-9.3.0...

EUVD-2026-100883

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-106166 NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-106166

The NEX-Forms WordPress plugin (versions before 9.3.1 ) is vulnerable to an authorization bypass because it fails to perform adequate authorization, ownership, or request-validation checks when updating stored form entries. An unauthenticated attacker can exploit this by referencing a sequential ...

PT-2026-113662

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-106166: Authorization Bypass Through User-Controlled Key

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-96607

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1...

CVE-2026-96607 WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1...