CVE-2026-57668
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The NEX-Forms plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 9.2.2.
Risk Assessment
An attacker can inject malicious scripts that execute in the browsers of administrators or users viewing pages with forms, potentially leading to session theft, account takeover, or website defacement.
Recommendation
Immediately update the NEX-Forms plugin to a version newer than 9.2.2 if available, or apply temporary mitigations such as input filtering and disabling unused forms.
Other vulnerabilities in NEX-Forms
See all- CVE-2026-12142High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the '_name[]' array parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page.
- CVE-2026-15602Medium
The NEX-Forms plugin for WordPress up to version 9.2.4 is vulnerable to generic SQL Injection via the 'additional_params' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with admin-level access to append additional SQL queries. This is a second-order vulnerability triggered during CSV export.
- CVE-2026-10525Medium
The NEX-Forms WordPress plugin before version 9.2.3 does not sanitize and escape some submitted form data before storing and displaying it in the admin dashboard, leading to a Stored Cross-Site Scripting (XSS) vulnerability. This allows unauthenticated users to perform XSS attacks against high-privilege users such as administrators when they view the submitted entries.
- CVE-2026-9017Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 has an authorization bypass vulnerability that allows unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users. Attackers can also send attacker-controlled email content to chosen recipient addresses.
- CVE-2026-13040High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.
- CVE-2026-12404Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 contains an authorization bypass vulnerability. Unauthenticated attackers can enumerate sequential report IDs and download complete form submission data, including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.2.2.