Skip to contentWebaways Nex-forms – Ultimate Forms Plugin For Wordpress vulnerabilities
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type HeaderCVE-2026-967677.2 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' ParameterCVE-2026-759614.9 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' ParameterCVE-2026-156024.9 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' ParameterCVE-2026-154508.1 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX ActionCVE-2026-90175.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' ParameterCVE-2026-130407.2 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array ParameterCVE-2026-121427.2 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport ClassCVE-2026-124045.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' ParameterCVE-2026-70464.9 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key NamesCVE-2026-50637.2 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_idCVE-2026-19477.5 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_licenseCVE-2026-19484.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information ExposureCVE-2025-155105.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL InjectionCVE-2025-101854.9 Medium
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records FunctionCVE-2025-42086.3 Medium
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site ScriptingCVE-2025-34686.4 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information ExposureCVE-2024-134985.3 Medium
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL InjectionCVE-2024-108624.9 Medium
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()CVE-2024-11305.3 Medium
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()CVE-2024-11295.3 Medium
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()CVE-2024-09075.3 Medium
- basixonline nex-forms, webaways nex-forms – ultimate forms plugin for wordpress +1 moreNEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX ActionsCVE-2020-366706.3 Medium