CVE-2026-10525
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The NEX-Forms WordPress plugin before version 9.2.3 does not sanitize and escape some submitted form data before storing and displaying it in the admin dashboard, leading to a Stored Cross-Site Scripting (XSS) vulnerability. This allows unauthenticated users to perform XSS attacks against high-privilege users such as administrators when they view the submitted entries.
Risk Assessment
The risk involves potential compromise of administrator accounts or unauthorized actions in the WordPress admin panel by an unauthenticated attacker, which could lead to full site compromise.
Recommendation
Immediately update the NEX-Forms plugin to version 9.2.3 or later, which includes the necessary security fixes to eliminate the XSS vulnerability.
Other vulnerabilities in NEX-Forms
See all- CVE-2026-12142High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the '_name[]' array parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page.
- CVE-2026-15602Medium
The NEX-Forms plugin for WordPress up to version 9.2.4 is vulnerable to generic SQL Injection via the 'additional_params' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with admin-level access to append additional SQL queries. This is a second-order vulnerability triggered during CSV export.
- CVE-2026-57668High
The NEX-Forms plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 9.2.2.
- CVE-2026-9017Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 has an authorization bypass vulnerability that allows unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users. Attackers can also send attacker-controlled email content to chosen recipient addresses.
- CVE-2026-13040High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.
- CVE-2026-12404Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 contains an authorization bypass vulnerability. Unauthenticated attackers can enumerate sequential report IDs and download complete form submission data, including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.
Original NVD description (English source)
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.