webaways NEX-Forms – Ultimate Forms Plugin for WordPress

• CVE-2026-96767 High 7.2 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header 0.4%
• CVE-2026-75961 Medium 4.9 NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter 0.5%
• CVE-2026-15602 Medium 4.9 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter 0.4%
• CVE-2026-15450 High 8.1 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter 0.6%
• CVE-2026-9017 Medium 5.3 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action 0.5%
• CVE-2026-13040 High 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter 0.5%
• CVE-2026-12142 High 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter 0.5%
• CVE-2026-12404 Medium 5.3 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class 0.5%
• CVE-2026-7046 Medium 4.9 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter 0.4%
• CVE-2026-5063 High 7.2 NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names 0.2%
• CVE-2026-1947 High 7.5 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id 0.3%
• CVE-2026-1948 Medium 4.3 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license 0.2%
• CVE-2025-15510 Medium 5.3 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure 0.3%
• CVE-2025-10185 Medium 4.9 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection 0.3%
• CVE-2025-3468 Medium 6.4 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting 0.2%
• CVE-2025-4208 Medium 6.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function 0.4%
• CVE-2024-13498 Medium 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure 0.4%
• CVE-2024-10862 Medium 4.9 NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection 0.6%
• CVE-2024-1130 Medium 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() 0.6%
• CVE-2024-1129 Medium 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() 0.6%
• CVE-2024-0907 Medium 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() 0.6%
• CVE-2020-36670 Medium 6.3 NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions 0.6%