CVE-2026-10525
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The NEX-Forms WordPress plugin before version 9.2.3 does not sanitize and escape some submitted form data before storing and displaying it in the admin dashboard, leading to a Stored Cross-Site Scripting (XSS) vulnerability. This allows unauthenticated users to perform XSS attacks against high-privilege users such as administrators when they view the submitted entries.
Risk Assessment
The risk involves potential compromise of administrator accounts or unauthorized actions in the WordPress admin panel by an unauthenticated attacker, which could lead to full site compromise.
Recommendation
Immediately update the NEX-Forms plugin to version 9.2.3 or later, which includes the necessary security fixes to eliminate the XSS vulnerability.
Other vulnerabilities in NEX-Forms
See all- CVE-2026-12142High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the '_name[]' array parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page.
- CVE-2026-96607High
A Reflected Cross-Site Scripting (XSS) vulnerability in the NEX-Forms plugin for WordPress, affecting versions up to 9.3.1, allows an attacker to inject malicious scripts into the page.
- CVE-2026-75961Medium
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping and lack of preparation on the existing SQL query. Authenticated attackers with custom-level access can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-15602Medium
The NEX-Forms plugin for WordPress up to version 9.2.4 is vulnerable to generic SQL Injection via the 'additional_params' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with admin-level access to append additional SQL queries. This is a second-order vulnerability triggered during CSV export.
- CVE-2026-57668High
The NEX-Forms plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 9.2.2.
- CVE-2026-9017Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 has an authorization bypass vulnerability that allows unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users. Attackers can also send attacker-controlled email content to chosen recipient addresses.
- CVE-2026-13040High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.
- CVE-2026-12404Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 contains an authorization bypass vulnerability. Unauthenticated attackers can enumerate sequential report IDs and download complete form submission data, including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.
- CVE-2025-10185Medium
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the action nf_load_form_entries in all versions up to, and including, 9.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower-level users if access is granted by a site administrator.
Original NVD description (English source)
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS