Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

NEX-Forms – Ultimate Forms Plugin for WordPress — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in NEX-Forms – Ultimate Forms Plugin for WordPress, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses for the NEX-Forms Ultimate Forms Plugin for WordPress, categorized by vendor advisories, specific vulnerability types, and relevant security tags. The collection encompasses a comprehensive range of reported issues, including cross-site scripting, SQL injection, and unauthorized data access, covering the period from the plugin's initial release through the most recent public disclosures. Visitors can utilize this resource to track ongoing vendor advisories for NEX-Forms, gain a deeper understanding of how specific weakness classes affect form processing in WordPress environments, or review the complete historical vulnerability record of this particular product. By centralizing these findings, the page serves as a critical reference for security professionals, system administrators, and developers seeking to assess risk exposure and implement necessary mitigations for sites utilizing this software. The data presented reflects publicly disclosed information without commercial endorsement, ensuring an objective view of the plugin's security posture over time. Users are encouraged to review the detailed entries to understand the context, impact, and remediation steps associated with each identified flaw. This aggregation aims to support proactive security management by providing a clear, chronological overview of threats that have been identified and addressed within the NEX-Forms ecosystem.

Vendor: webaways

CVE ID Title CVSS Severity Published
CVE-2026-75961 NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter CWE-89 4.9 Medium 2026-09-18
CVE-2026-15602 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter CWE-89 4.9 Medium 2026-08-16
CVE-2026-15450 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CWE-22 8.1 High 2026-08-01
CVE-2026-9017 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action CWE-862 5.3 Medium 2026-07-11
CVE-2026-13040 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter CWE-79 7.2 High 2026-07-03
CVE-2026-12142 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter CWE-79 7.2 High 2026-07-01
CVE-2026-12404 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class CWE-862 5.3 Medium 2026-06-27
CVE-2026-7046 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter CWE-89 4.9 Medium 2026-05-15
CVE-2026-5063 NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names CWE-79 7.2 High 2026-05-03
CVE-2026-1947 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id CWE-639 7.5 High 2026-03-15
CVE-2026-1948 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license CWE-862 4.3 Medium 2026-03-14
CVE-2025-15510 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure CWE-862 5.3 Medium 2026-01-31
CVE-2025-10185 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection CWE-89 4.9 Medium 2025-10-11
CVE-2025-3468 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-05-08
CVE-2025-4208 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function CWE-94 6.3 Medium 2025-05-08
CVE-2024-13498 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure CWE-200 5.3 Medium 2025-03-12
CVE-2024-10862 NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection CWE-89 4.9 Medium 2024-12-25
CVE-2024-1130 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() CWE-862 5.3 Medium 2024-02-01
CVE-2024-1129 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() CWE-862 5.3 Medium 2024-02-01
CVE-2024-0907 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() CWE-862 5.3 Medium 2024-02-01
CVE-2020-36670 NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions CWE-862 6.3 Medium 2023-03-07

All 21 known CVE vulnerabilities affecting NEX-Forms – Ultimate Forms Plugin for WordPress with full Chinese analysis, references, and POCs where available.