CVE-2022-3142

Affected software: NEX-Forms WordPress plugin, versions before 7.9.7. Vulnerability: SQL injection due to improper sanitisation/escaping of user input used in SQL statements. Exploitation requires permissions to view the forms statistics chart (by default administrators), with potential to be con...

CVE-2024-1129

CVE-2024-1129 concerns NEX-Forms – Ultimate Form Builder for WordPress. The vulnerability is due to a missing capability check in set_starred() across all versions up to 8.5.6, allowing authenticated subscribers+ to mark records as starred. Connected sources indicate a patch in version 8.5.7 (and...

CVE-2023-2114

CVE-2023-2114 concerns the NEX-Forms WordPress plugin (pre-8.4) where the table parameter (populated with user input) is not properly escaped before being concatenated into an SQL query. Root cause: lack of input sanitization for the table parameter in the form-save workflow, enabling SQL Injecti...

CVE-2025-4208

CVE-2025-4208 affects the WordPress plugin “NEX-Forms – Ultimate Forms Plugin for WordPress.” The issue is a Limited Code Execution vulnerability in versions up to 8.9.1 caused by unsanitized user input being passed to call_user_func() inside the get_table_records function. This allows an authent...

CVE-2021-34676

Summary: CVE-2021-34676 affects Basix NEX-Forms (WordPress plugin) up to version 7.8.7. The underlying issue is an authentication bypass in the Excel report generation feature, enabling unauthenticated users to download Excel reports. The vulnerability is described consistently across multiple so...

CVE-2024-25593

CVE-2024-25593 affects NEX-Forms – Ultimate Form Builder for WordPress (

CVE-2025-3468

CVE-2025-3468 affects the WordPress plugin NEX-Forms – Ultimate Form Builder . It is a Stored Cross-Site Scripting flaw exploitable via the clean_html and form_fields parameters in all versions up to and including 8.9.1. The issue requires an authenticated attacker with Custom-level access and ca...

CVE-2024-1130

The CVE CVE-2024-1130 concerns the WordPress plugin NEX-Forms – Ultimate Form Builder. A missing capability check in the set_read() function allowed authenticated users with subscriber+ access to mark records as read, affecting all versions up to 8.5.6. Publicly disclosed remediation indicates th...

CVE-2023-0272

CVE-2023-0272: NEX-Forms WordPress plugin before 8.3.3 is vulnerable to Stored XSS due to failure to validate/escape certain shortcode attributes before output. This can allow users with the contributor role and above to inject malicious scripts via shortcodes embedded in posts/pages. Root cause:...

CVE-2024-0907

CVE-2024-0907 affects the WordPress plugin NEX-Forms – Ultimate Form Builder (restore_records() function). Root cause: missing capability check allows unauthorized access to restore records. Affected versions: all up to and including 8.5.6 (per CVE entry). Impact: authenticated users with subscri...

CVE-2015-9452

CVE-2015-9452 affects the WordPress plugin nex-forms-express-wp-form-builder prior to version 4.6.1, with an SQL injection vulnerability exploitable via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter. The issue is documented across multiple sources; CVSS shows high to critical ...

CVE-2021-34675

CVE-2021-34675 affects the WordPress Basix NEX-Forms plugin up to version 7.8.7. The vulnerability is an authentication bypass that allows access to stored PDF reports without valid credentials. The issue is documented across multiple sources (NVD, Red Hat, CNVD, WPVulnDB) as an authentication by...

CVE-2021-24705

CVE-2021-24705 affects the NEX-Forms WordPress plugin prior to version 8.4.3. The issue is lack of CSRF protection when editing a form and insufficient escaping of certain settings and form fields before output in attributes, enabling a logged-in admin to edit forms with stored Cross-Site Scripti...

CVE-2023-0439

CVE-2023-0439 affects the NEX-Forms WordPress plugin (versions prior to 8.4.4). The root cause is improper escaping of the form name, enabling a Stored XSS vulnerability. By default, only SuperAdmins/admins can create forms, but a setting can grant lower roles this ability, potentially broadening...

CVE-2024-53808

CVE-2024-53808 : SQL Injection in WordPress plugin “NEX-Forms – Ultimate Form Builder” (Basix NEX-Forms) ≤ 8.7.8. Root cause: improper neutralization of input in SQL commands. Affected products/versions: NEX-Forms – Ultimate Form Builder up to 8.7.8. Exploitation status in provided docs: not indi...

CVE-2023-50838

CVE-2023-50838 corresponds to an SQL Injection vulnerability in NEX-Forms – Ultimate Form Builder for WordPress. The issue affects the NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin, up to version 8.5.5. According to sources, this was an authenticated issue requiring at le...

CVE-2024-10862

CVE-2024-10862 affects the WordPress plugin “NEX-Forms – Ultimate Form Builder”. The issue is an authenticated SQL Injection via the search_params parameter in the affected queries, exploitable in versions up to 8.7.13 (and disclosed under authenticated admin context). Root cause: insufficient es...

CVE-2024-37512

CVE-2024-37512 is a Stored XSS in Basix NEX-Forms – Ultimate Form Builder (WordPress plugin) affecting versions up to 8.5.10. The vulnerability stems from improper neutralization of input during web page generation. Public advisories from NVD/Red Hat and CVE records confirm the issue as Stored XS...

CVE-2024-47389

CVE-2024-47389 affects WordPress NEX-Forms – Ultimate Form Builder (plugin

CVE-2020-36670

The CVE-2020-36670 entry concerns the NEX-Forms plugin for WordPress up to version 7.7.1. The vulnerability stems from missing capability checks on several AJAX actions, enabling authenticated attackers with subscriber-level permissions and above to perform unauthorized data disclosure and modifi...

CVE-2023-52120

Technical details for CVE-2023-52120 are not provided in the supplied documents. No product/version/impact specifics are available here; monitor for official advisories and updates.