NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities

Product

NEX-Forms – Ultimate Forms Plugin for WordPress

by webaways · last CVE Oct 29, 2026

CVEs

On KEV

8.1

Max CVSS

New 30D

Severity mix

Critical 0High 6Medium 15Low 0

Severity

Exploitation

Watch

Add NEX-Forms – Ultimate Forms Plugin for WordPress to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-15450	8.1	1%	Aug 1	NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter Affected: through 9.2.3
CVE-2026-1947	7.5	0%	Mar 15	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id Affected: through 9.1.9
CVE-2026-96767 New	7.2	–	Oct 29	NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header Affected: through 9.3.2
CVE-2026-13040	7.2	1%	Jul 3	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter Affected: through 9.2.2
CVE-2026-12142	7.2	1%	Jul 1	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter Affected: through 9.2.2
CVE-2026-5063	7.2	0%	May 3	NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names Affected: through 9.1.11