NU
Product
NEX-Forms – Ultimate Forms Plugin for WordPress
21
CVEs
0
On KEV
8.1
Max CVSS
1
New 30D
Severity mix
Critical 0High 6Medium 15Low 0
Watch
Add NEX-Forms – Ultimate Forms Plugin for WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-15450 | 8.1 | Aug 1 | NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter Affected: through 9.2.3 |
| CVE-2026-1947 | 7.5 | Mar 15 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id Affected: through 9.1.9 |
| CVE-2026-96767 New | 7.2 | Oct 29 | NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header Affected: through 9.3.2 |
| CVE-2026-13040 | 7.2 | Jul 3 | NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter Affected: through 9.2.2 |
| CVE-2026-12142 | 7.2 | Jul 1 | NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter Affected: through 9.2.2 |
| CVE-2026-5063 | 7.2 | May 3 | NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names Affected: through 9.1.11 |
| CVE-2025-4208 | 6.3 | May 8 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function Affected: through 8.9.1 |
| CVE-2025-3468 | 5.4 | May 8 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting Affected: through 8.9.1 |
| CVE-2026-9017 | 5.3 | Jul 11 | NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action Affected: through 9.2.2 |
| CVE-2026-12404 | 5.3 | Jun 27 | NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class Affected: through 9.2.2 |
| CVE-2025-15510 | 5.3 | Jan 31 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure Affected: through 9.1.8 |
| CVE-2024-13498 | 5.3 | Mar 12 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure Affected: through 8.8.1 |
| CVE-2026-75961 | 4.9 | Sep 18 | NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter Affected: through 9.3.0 |
| CVE-2026-15602 | 4.9 | Aug 16 | NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter Affected: through 9.2.4 |
| CVE-2026-7046 | 4.9 | May 15 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter Affected: through 9.1.12 |
| CVE-2025-10185 | 4.9 | Oct 11 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection Affected: through 9.1.6 |
| CVE-2024-10862 | 4.9 | Dec 25 | NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection Affected: through 8.7.15 |
| CVE-2026-1948 | 4.3 | Mar 14 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license Affected: through 9.1.9 |
| CVE-2024-1130 | 4.3 | Feb 1 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() Affected: through 8.5.6 |
| CVE-2024-1129 | 4.3 | Feb 1 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() Affected: through 8.5.6 |
| CVE-2024-0907 | 4.3 | Feb 1 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() Affected: through 8.5.6 |
Showing 21