EUVD-2026-41487
GHSA-vm43-p47r-7qww
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable no-nonce endpoint gives AV:N/AC:L/PR:N/UI:N; stored XSS executes in a different (victim browser) context so S:C with limited C:L/I:L and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The submission endpoint is registered via wp_ajax_nopriv_submit_nex_form with no nonce verification, making it fully accessible to unauthenticated attackers without any CSRF token.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the NEX-Forms - Ultimate Forms Plugin for WordPress (all versions through 9.2.2) lets unauthenticated attackers persist arbitrary JavaScript via the 'real_val__' form-submission parameter, which later executes in the browser of any user who views the affected page. The flaw is amplified by a design weakness: the submission handler is registered through wp_ajax_nopriv_submit_nex_form with no nonce/CSRF verification, so no authentication or valid session is required to reach the vulnerable sink. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the NEX-Forms plugin (≤ 9.2.2) be installed and active and that its AJAX submission endpoint (wp_ajax_nopriv_submit_nex_form via admin-ajax.php) be reachable - which it is by default for unauthenticated visitors, and it performs no nonce/CSRF check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network reachable, low complexity, no privileges, no user interaction to inject, and a changed scope reflecting execution in a victim's browser security context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted POST to wp-admin/admin-ajax.php invoking the nopriv submit_nex_form action with a 'real_val__' value containing a script payload; because the endpoint requires no login and no nonce, the request is accepted and stored. When a site administrator later opens the submissions/entries view to review form data, the payload executes in their authenticated session, enabling session/cookie theft or admin-action forgery. … |
| Remediation | No fixed version number is stated in the provided data, so the specific patched release is not independently confirmed; an upstream fix appears staged in the plugin repository changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3584399%40nex-forms-express-wp-form-builder&new=3584399%40nex-forms-express-wp-form-builder), meaning a corrected build is likely available or imminent. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress instances for NEX-Forms plugin presence and confirm installed versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today