Plugin icon

NEX-Forms – Ultimate Forms Plugin for WordPress

nex-forms-express-wp-form-builder

Vulnerabilities:

30

Last Updated:

April 23, 2026

Active Installs:

7000

Published
Title
Fixed in
CVSS
Published
2026-05-02
Title
NEX-Forms < 9.1.12 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
Fixed in
Fixed in 9.1.12
CVSS
7.2 (high)
Published
2026-03-14
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.10 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
Fixed in
Fixed in 9.1.10
CVSS
7.5 (high)
Published
2026-03-13
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.10 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
Fixed in
Fixed in 9.1.10
CVSS
4.3 (medium)
Published
2026-02-09
Title
NEX-Forms < 9.1.8 - Reflected Cross-Site Scripting
Fixed in
Fixed in 9.1.8
CVSS
6.1 (medium)
Published
2026-02-04
Title
NEX-Forms < 9.1.8 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 9.1.8
CVSS
7.2 (high)
Published
2026-01-30
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.9 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 9.1.9
CVSS
5.3 (medium)
Published
2025-12-19
Title
Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSS
Fixed in
Fixed in 9.1.8
CVSS
6.8 (medium)
Published
2025-10-10
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.7 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 9.1.7
CVSS
4.9 (medium)
Published
2025-08-20
Title
NEX-Forms < 9.1.4 - Cross-Site Request Forgery
Fixed in
Fixed in 9.1.4
CVSS
4.3 (medium)
Published
2025-05-07
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.9.2 - Authenticated (Custom) Limited Code Execution via get_table_records Function
Fixed in
Fixed in 8.9.2
CVSS
6.3 (medium)
Published
2025-05-07
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.9.2 - Authenticated (Custom) Stored Cross-Site Scripting
Fixed in
Fixed in 8.9.2
CVSS
6.4 (medium)
Published
2025-03-11
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.8.2 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 8.8.2
CVSS
5.3 (medium)
Published
2024-12-24
Title
NEX-Forms < 8.7.16 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 8.7.16
CVSS
4.9 (medium)
Published
2024-12-02
Title
NEX-Forms – Ultimate Form Builder < 8.7.9 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 8.7.9
CVSS
4.9 (medium)
Published
2024-09-30
Title
NEX-Forms – Ultimate Form Builder < 8.7.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 8.7.4
CVSS
6.1 (medium)
Published
2024-07-05
Title
NEX-Forms – Ultimate Form Builder < 8.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 8.6.1
CVSS
6.4 (medium)
Published
2024-02-12
Title
NEX-Forms – Ultimate Form Builder < 8.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Fixed in
Fixed in 8.5.6
CVSS
6.4 (medium)
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via set_starred()
Fixed in
Fixed in 8.5.7
CVSS
5.3 (medium)
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via restore_records()
Fixed in
Fixed in 8.5.7
CVSS
5.3 (medium)
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via set_read()
Fixed in
Fixed in 8.5.7
CVSS
5.3 (medium)
Published
2023-12-28
Title
NEX-Forms – Ultimate Form Builder < 8.5.5 - Cross-Site Request Forgery
Fixed in
Fixed in 8.5.5
CVSS
4.3 (medium)
Published
2023-12-21
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.6 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 8.5.6
CVSS
5.5 (medium)
Published
2023-06-26
Title
NEX-Forms < 8.4.4 - Authenticated Stored XSS
Fixed in
Fixed in 8.4.4
CVSS
3.5 (low)
Published
2023-04-17
Title
NEX-Forms < 8.4 - Admin+ SQL Injection
Fixed in
Fixed in 8.4
CVSS
4.1 (medium)
Published
2023-02-28
Title
NEX-Forms < 8.3.3 - Contributor+ Stored XSS
Fixed in
Fixed in 8.3.3
CVSS
6.8 (medium)
Published
2022-08-01
Title
NEX-Forms < 7.9.7 - Authenticated SQLi
Fixed in
Fixed in 7.9.7
CVSS
6.8 (medium)
Published
2021-11-15
Title
NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF
Fixed in
Fixed in 8.4.3
CVSS
7.1 (high)
Published
2020-11-27
Title
NEX-Forms < 7.8 - Subscriber+ Unauthorised AJAX Calls
Fixed in
Fixed in 7.8
CVSS
6.3 (medium)
Published
2015-07-16
Title
NEX-Forms < 4.6.1 - Unauthenticated Blind SQL Injection
Fixed in
Fixed in 4.6.1
CVSS
9.8 (critical)
Published
2015-04-21
Title
NEX-Forms - Ultimate Form builder <= 3.0 - SQL Injection
Fixed in
Fixed in 3.1
CVSS
n/a