CVE-2026-13040
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.
Risk Assessment
Unauthenticated attackers can inject malicious JavaScript, leading to session hijacking, redirection to malicious sites, or data theft from users visiting compromised pages.
Recommendation
Immediately update the NEX-Forms plugin to the latest version and implement CSRF protections (e.g., nonce tokens) for AJAX endpoints.
Other vulnerabilities in NEX-Forms
See all- CVE-2026-12142High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the '_name[]' array parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page.
- CVE-2026-15602Medium
The NEX-Forms plugin for WordPress up to version 9.2.4 is vulnerable to generic SQL Injection via the 'additional_params' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with admin-level access to append additional SQL queries. This is a second-order vulnerability triggered during CSV export.
- CVE-2026-10525Medium
The NEX-Forms WordPress plugin before version 9.2.3 does not sanitize and escape some submitted form data before storing and displaying it in the admin dashboard, leading to a Stored Cross-Site Scripting (XSS) vulnerability. This allows unauthenticated users to perform XSS attacks against high-privilege users such as administrators when they view the submitted entries.
- CVE-2026-57668High
The NEX-Forms plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 9.2.2.
- CVE-2026-9017Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 has an authorization bypass vulnerability that allows unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users. Attackers can also send attacker-controlled email content to chosen recipient addresses.
- CVE-2026-12404Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 contains an authorization bypass vulnerability. Unauthenticated attackers can enumerate sequential report IDs and download complete form submission data, including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.
Original NVD description (English source)
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The submission endpoint is registered via wp_ajax_nopriv_submit_nex_form with no nonce verification, making it fully accessible to unauthenticated attackers without any CSRF token.