Security
فارسی
All products

nex-forms-express-wp-form-builder

WordPress · Plugin
44 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type HeaderCVE-2026-96767 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms – Ultimate Forms Plugin for WordPress 9.2.1 - 9.3.0 - Unauthenticated Insecure Direct Object ReferenceCVE-2026-106166 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingCVE-2026-96607 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' ParameterCVE-2026-75961 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' ParameterCVE-2026-15602 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' ParameterCVE-2026-15450 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-10525 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-57668 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX ActionCVE-2026-9017 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' ParameterCVE-2026-13040 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array ParameterCVE-2026-12142 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport ClassCVE-2026-12404 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' ParameterCVE-2026-7046 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key NamesCVE-2026-5063 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_idCVE-2026-1947 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_licenseCVE-2026-1948 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms <= 9.1.7 - Reflected Cross-Site ScriptingCVE-2025-69326 nex-forms-express-wp-form-builder WordPress Medium Fix reported
NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-69324 nex-forms-express-wp-form-builder WordPress High Fix reported
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information ExposureCVE-2025-15510 nex-forms-express-wp-form-builder WordPress Medium Fix reported
Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site ScriptingCVE-2025-14803 nex-forms-express-wp-form-builder WordPress Medium Fix reported