High severity · published Oct 29, 2026
CVE-2026-96767
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
New
7.2
CVSS
–
EPSS
No
On KEV
Description
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NU
NEX-Forms – Ultimate Forms Plugin for WordPress · webaways
through 9.3.2 · source: vendor
Affected product
NU
NEX-Forms – Ultimate Forms Plugin for WordPress
webaways
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96767
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/includes/classes/class.dashboard.php#L4631
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/includes/classes/class.functions.php#L2341
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/main.php#L2684
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/main.php#L2844
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/main.php#L3051
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?reponame=&old=3755941%40nex-forms-express-wp-form-builder&new=3755941%40nex-forms-express-wp-form-builder
More from NEX-Forms – Ultimate Forms Plugin for WordPress
8.1
CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
7.5
CVE-2026-1947
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
7.2
CVE-2026-13040
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
7.2
CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
7.2
CVE-2026-5063
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names