CVE-2026-75961
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping and lack of preparation on the existing SQL query. Authenticated attackers with custom-level access can append additional SQL queries to extract sensitive information from the database.
Risk Assessment
An attacker with custom-level access can extract sensitive information from the database, potentially breaching data confidentiality. Exploitation requires an account with specific privileges.
Recommendation
Update the NEX-Forms plugin to a version later than 9.3.0. Restrict user privileges and monitor for unusual database queries.
Other vulnerabilities in NEX-Forms
See all- CVE-2026-12142High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the '_name[]' array parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page.
- CVE-2026-15602Medium
The NEX-Forms plugin for WordPress up to version 9.2.4 is vulnerable to generic SQL Injection via the 'additional_params' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with admin-level access to append additional SQL queries. This is a second-order vulnerability triggered during CSV export.
- CVE-2026-10525Medium
The NEX-Forms WordPress plugin before version 9.2.3 does not sanitize and escape some submitted form data before storing and displaying it in the admin dashboard, leading to a Stored Cross-Site Scripting (XSS) vulnerability. This allows unauthenticated users to perform XSS attacks against high-privilege users such as administrators when they view the submitted entries.
- CVE-2026-57668High
The NEX-Forms plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects all versions up to and including 9.2.2.
- CVE-2026-9017Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 has an authorization bypass vulnerability that allows unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users. Attackers can also send attacker-controlled email content to chosen recipient addresses.
- CVE-2026-13040High
The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.
- CVE-2026-12404Medium
The NEX-Forms plugin for WordPress up to version 9.2.2 contains an authorization bypass vulnerability. Unauthenticated attackers can enumerate sequential report IDs and download complete form submission data, including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.
Original NVD description (English source)
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The operator allowlist applied by get_table_records() when building its own WHERE fragment is not enforced on the same tainted additional_params array when it is forwarded to get_total_records(), leaving the SQL sink unprotected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS