What is the CVSS score of CVE-2026-5063?

CVE-2026-5063 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of NEX-Forms WordPress Plugin are affected by CVE-2026-5063?

CVE-2026-5063 is a stored cross-site scripting vulnerability in NEX-Forms WordPress plugin (≤9.1.11) that allows unauthenticated attackers to inject persistent malicious scripts through form…

How to fix or mitigate CVE-2026-5063?

Within 24 hours: identify all WordPress instances running NEX-Forms plugin and document current versions; disable the plugin if business-critical functionality can be deferred. Within 7 days: contact plugin vendor for patch timeline and implement a Web Application Firewall (WAF) rule blocking POST requests with suspicious parameter key names to NEX-Forms endpoints. Within 30 days: upgrade to a patched version upon vendor release, or migrate to an alternative form plugin if no patch is released by vendor within 60 days.

NEX-Forms WordPress Plugin CVE-2026-5063

EUVD-2026-26815 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-03 Wordfence

WordPress XSS Wordpress Plugin Nex Forms Ultimate Forms Plugin For Wordpress Webaways

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 03, 2026 - 06:30 vuln.today

EUVD ID Assigned

May 03, 2026 - 06:00 euvd

EUVD-2026-26815

Analysis Generated

May 03, 2026 - 06:00 vuln.today

CVE Published

May 03, 2026 - 04:25 nvd

HIGH 7.2

DescriptionCVE.org

The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submit_nex_form() function in versions up to, and including, 9.1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in NEX-Forms WordPress plugin versions ≤9.1.11 allows unauthenticated remote attackers to inject malicious JavaScript through crafted POST parameter key names during form submission. Exploitation requires no authentication (CVSS PR:N) and persists across page loads, affecting any user viewing injected content. The CVSS vector indicates changed scope (S:C), meaning attackers can impact resources beyond the vulnerable component's security scope. No active exploitation confirmed via CISA KEV at time of analysis, but WordPress XSS vulnerabilities typically see rapid weaponization once disclosed.

Technical ContextAI

NEX-Forms is a WordPress form builder plugin by Webaways. The vulnerability exists in the submit_nex_form() function which processes form submissions. The flaw stems from improper handling of POST parameter key names - the plugin sanitizes parameter values but fails to sanitize or encode the parameter names themselves before storing them in the WordPress database. When administrators or users later view form submission data through the plugin's admin interface or frontend display pages, these malicious key names are rendered without proper output escaping, executing attacker-controlled JavaScript. This represents a classic CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability, where user-supplied data flows from input (form submission) through storage (database) to output (rendered page) without adequate sanitization at any stage. The changed scope (S:C) in the CVSS vector indicates the injected scripts can access data or perform actions outside the plugin's normal security boundary, potentially compromising WordPress admin sessions or other plugin data.

RemediationAI

Update NEX-Forms plugin to version 9.1.12 or later immediately through the WordPress admin dashboard (Plugins > Updates) or by downloading the patched release from the official WordPress plugin repository. The fix implemented in changeset 3513524 adds proper sanitization of POST parameter key names in the submit_nex_form() function and output escaping when rendering stored form data. Before patching, review all existing form submissions in NEX-Forms admin interface for suspicious JavaScript patterns in field names - if found, manually delete those entries from the database. If immediate patching is not possible, implement these compensating controls with noted trade-offs: (1) Temporarily deactivate the NEX-Forms plugin until patching - breaks all forms on site but eliminates attack surface; (2) Restrict /wp-admin/ access to trusted IP addresses via .htaccess or firewall rules - reduces XSS payload execution risk but does not prevent injection and limits legitimate remote admin access; (3) Deploy WordPress security plugin with XSS filtering (e.g., Wordfence WAF) configured to inspect POST parameter names - may cause false positives on legitimate unusual form field names. Post-remediation, audit WordPress admin accounts for unauthorized changes and review web server logs for POST requests with JavaScript patterns in parameter names since initial disclosure.