What’s Vulnerable › Products
webaways NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities
43 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.
Check whether your webaways NEX-Forms – Ultimate Forms Plugin for WordPress version is affected
Latest webaways NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities
- CVE-2026-96767 — NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header (CVSS 7.2)
- CVE-2026-106166 — NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter (CVSS 5.3)
- CVE-2026-96607 — WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-75961 — NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter (CVSS 4.9)
- CVE-2026-15602 — NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter (CVSS 4.9)
- CVE-2026-15450 — NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter (CVSS 8.1)
- CVE-2026-10525 — NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission (CVSS 6.1)
- CVE-2026-57668 — WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-9017 — NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action (CVSS 5.3)
- CVE-2026-13040 — NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter (CVSS 7.2)
- CVE-2026-12142 — NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter (CVSS 7.2)
- CVE-2026-12404 — NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class (CVSS 5.3)
- CVE-2026-7046 — NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter (CVSS 4.9)
- CVE-2026-5063 — NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names (CVSS 7.2)
- CVE-2026-1948 — NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license (CVSS 4.3)
- CVE-2026-1947 — NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id (CVSS 7.5)
- CVE-2025-69326 — WordPress NEX-Forms plugin <= 9.1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2025-69324 — WordPress NEX-Forms plugin <= 9.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2025-15510 — NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- CVE-2025-14803 — Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSS (CVSS 6.8)
- CVE-2025-10185 — NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection (CVSS 4.9)
- CVE-2025-49399 — WordPress NEX-Forms Plugin <= 9.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8)
- CVE-2025-4208 — NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function (CVSS 6.3)
- CVE-2025-3468 — NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2024-13498 — NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)