Webaways vulnerabilities

Products

• Nex-forms – Ultimate Forms Plugin For Wordpress 22
• Nex-forms – Ultimate Form Builder – Contact Forms And Much More 3

Newest

• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header CVE-2026-96767 7.2 HighOctober 29, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter CVE-2026-75961 4.9 MediumSeptember 18, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter CVE-2026-15602 4.9 MediumAugust 16, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CVE-2026-15450 8.1 HighAugust 1, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action CVE-2026-9017 5.3 MediumJuly 11, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter CVE-2026-13040 7.2 HighJuly 3, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter CVE-2026-12142 7.2 HighJuly 1, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class CVE-2026-12404 5.3 MediumJune 27, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter CVE-2026-7046 4.9 MediumMay 15, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names CVE-2026-5063 7.2 HighMay 3, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id CVE-2026-1947 7.5 HighMarch 15, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license CVE-2026-1948 4.3 MediumMarch 14, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVE-2025-15510 5.3 MediumJanuary 31, 2026
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection CVE-2025-10185 4.9 MediumOctober 11, 2025
• basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 more NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function CVE-2025-4208 6.3 MediumMay 8, 2025
• basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 more NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting CVE-2025-3468 6.4 MediumMay 8, 2025
• webaways nex-forms – ultimate forms plugin for wordpress NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure CVE-2024-13498 5.3 MediumMarch 12, 2025
• basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 more NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection CVE-2024-10862 4.9 MediumDecember 25, 2024
• basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 more NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() CVE-2024-1130 5.3 MediumFebruary 1, 2024
• basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 more NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() CVE-2024-1129 5.3 MediumFebruary 1, 2024
• basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 more NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() CVE-2024-0907 5.3 MediumFebruary 1, 2024
• basix nex-forms – ultimate form builder – contact forms and much more, basixonline nex-forms +1 more WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-52120 5.4 MediumJanuary 5, 2024
• basix nex-forms – ultimate form builder – contact forms and much more, basixonline nex-forms +1 more WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.5 is vulnerable to SQL Injection CVE-2023-50838 7.6 HighDecember 28, 2023
• basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 more NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions CVE-2020-36670 6.3 MediumMarch 7, 2023
• basixonline nex-forms, unknown nex-forms – ultimate form builder – contact forms and much more +1 more NEX-Forms < 7.9.7 - Authenticated SQLi CVE-2022-3142 Public exploit EPSS 14.6% 8.8 HighSeptember 19, 2022