EUVD-2026-45144
GHSA-cfgv-8pp3-f8p8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated form submission grants PR:N; stored payload fires only when admin views entries (UI:R); XSS crosses into admin browser scope (S:C) with limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.
AnalysisAI
Stored Cross-Site Scripting in the NEX-Forms WordPress plugin before version 9.2.3 allows unauthenticated remote attackers to inject persistent malicious scripts into the admin dashboard by submitting crafted form data that is stored without sanitization and rendered without output escaping. When an administrator views the submitted entries panel, the stored payload executes in their browser, enabling session hijacking or secondary site takeover actions. A public proof-of-concept is available via WPScan, though EPSS data (0.24%, 14th percentile) and the SSVC Automatable:no classification indicate targeted rather than mass-automated exploitation at this time.
Technical ContextAI
NEX-Forms is a WordPress form-builder plugin that collects visitor-submitted data and surfaces it to site administrators through a dedicated entries view in the WordPress backend dashboard. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored/persistent variant: user-submitted field values are written to the WordPress database without sanitization (e.g., missing wp_kses() or sanitize_text_field() on input) and subsequently rendered to administrator users without HTML output escaping (e.g., missing esc_html() or esc_attr() on output). The affected CPE is cpe:2.3:a:unknown:nex-forms:*:*:*:*:*:*:*:*, covering all releases from version 0 through 9.2.2. The attack surface is any NEX-Forms instance with one or more forms accessible to unauthenticated public visitors whose submitted data is displayed in the admin entries view.
RemediationAI
Upgrade NEX-Forms to version 9.2.3 or later, which is the vendor-released patch that introduces proper sanitization of submitted form data before database storage and output escaping before rendering in the admin dashboard. The patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/d1e191e6-ff5b-4cb8-9b12-8ae73cf0d2f0/. If an immediate upgrade cannot be performed, a compensating control is to restrict access to the WordPress admin dashboard by IP allowlist or require VPN access, thereby reducing the population of users who could trigger the stored payload when viewing entries. Note that this control prevents detonation but does not prevent attacker payloads from being stored in the database - it is a temporary measure only. An additional measure is to disable or unpublish forms accessible to unauthenticated visitors until patching is complete, which eliminates the attacker's delivery vector entirely but may impact legitimate data collection operations.
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL stat
Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. Rated high severity (CVSS 7.5),
Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. Rated high severity (CVSS 7.5), this
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user i
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputt
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms ne
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms -
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms ne
Stored cross-site scripting in Basix NEX-Forms (WordPress form-builder plugin) affects all versions up to and including
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms -
The NEX-Forms - Ultimate Form Builder - Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-S
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today