Webaways
Monthly
Arbitrary file deletion via path traversal in the Nex Forms - Ultimate Form Builder - Lite WordPress plugin (versions up to and including 9.2.3) allows authenticated attackers to delete any file on the server, including the critical wp-config.php. The flaw stems from a two-stage attack chain: the insert_record() AJAX handler accepts unsanitized file paths (wp_kses() strips only HTML, not traversal sequences) into a database column, which the delete_file() AJAX handler then passes directly to PHP's unlink() without realpath(), basename(), or allowlist validation. By default this requires admin-level access, but the plugin's configurable user-level option may reduce the privilege requirement to lower roles. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Stored cross-site scripting in the NEX-Forms - Ultimate Forms Plugin for WordPress (all versions through 9.2.2) lets unauthenticated attackers persist arbitrary JavaScript via the 'real_val__' form-submission parameter, which later executes in the browser of any user who views the affected page. The flaw is amplified by a design weakness: the submission handler is registered through wp_ajax_nopriv_submit_nex_form with no nonce/CSRF verification, so no authentication or valid session is required to reach the vulnerable sink. There is no public exploit identified at time of analysis and no CISA KEV listing, but the unauthenticated, network-reachable nature makes it a practical mass-exploitation candidate against exposed WordPress sites.
Stored cross-site scripting in the NEX-Forms - Ultimate Forms Plugin for WordPress (all versions through 9.2.2) lets unauthenticated attackers persist arbitrary JavaScript via the '_name[]' array parameter, which then runs in the browser of any user who views the injected page. The flaw is notable because the plugin's own wp_kses() allow-list (NEXForms_allowed_tags()) deliberately whitelists <script>, <iframe src/srcdoc>, and JS event handlers, so the normal output-filtering layer provides no protection. No public exploit identified at time of analysis; the issue was reported by Wordfence and carries a CVSS 7.2 with a changed scope.
Stored Cross-Site Scripting in NEX-Forms WordPress plugin versions ≤9.1.11 allows unauthenticated remote attackers to inject malicious JavaScript through crafted POST parameter key names during form submission. Exploitation requires no authentication (CVSS PR:N) and persists across page loads, affecting any user viewing injected content. The CVSS vector indicates changed scope (S:C), meaning attackers can impact resources beyond the vulnerable component's security scope. No active exploitation confirmed via CISA KEV at time of analysis, but WordPress XSS vulnerabilities typically see rapid weaponization once disclosed.
CVE-2026-1947 is an Insecure Direct Object Reference vulnerability in NEX-Forms WordPress plugin (versions ≤9.1.9) that allows unauthenticated remote attackers to overwrite arbitrary form entries without any authentication. The vulnerability has a CVSS score of 7.5 and while not currently in KEV or having public POCs, it represents a significant data integrity risk for WordPress sites using this forms plugin.
Second-order SQL injection in NEX-Forms - Ultimate Forms Plugin for WordPress (versions through 9.2.4) enables authenticated attackers with admin-level access to extract arbitrary data from the WordPress database by abusing insufficient escaping on the 'additional_params' parameter. The attack is staged: a malicious payload is first stored via the submission_report2 AJAX handler, which notably lacks a nonce check and whose required capability can be configured down to subscriber-level, then the injection fires when an administrator triggers a CSV export. No public exploit or active exploitation has been confirmed at time of analysis, but the privilege-downgrade path on the AJAX handler meaningfully complicates the PR:H framing of the official CVSS vector.
Time-based blind SQL injection in NEX-Forms Ultimate Forms Plugin for WordPress through version 9.1.12 allows authenticated administrators to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'table' parameter. The vulnerability requires administrator-level access and is not actively exploited in public records, but poses significant risk to multi-admin WordPress installations where admin accounts may be compromised or untrusted.
The NEX-Forms Ultimate Forms Plugin for WordPress contains a missing capability check vulnerability in the deactivate_license() function, allowing authenticated attackers with Subscriber-level privileges to deactivate the plugin license without proper authorization. This authorization bypass affects all versions up to and including 9.1.9 and has a CVSS score of 4.3 (Low severity), indicating limited direct impact but meaningful privilege escalation concerns for multi-user WordPress installations.
Arbitrary file deletion via path traversal in the Nex Forms - Ultimate Form Builder - Lite WordPress plugin (versions up to and including 9.2.3) allows authenticated attackers to delete any file on the server, including the critical wp-config.php. The flaw stems from a two-stage attack chain: the insert_record() AJAX handler accepts unsanitized file paths (wp_kses() strips only HTML, not traversal sequences) into a database column, which the delete_file() AJAX handler then passes directly to PHP's unlink() without realpath(), basename(), or allowlist validation. By default this requires admin-level access, but the plugin's configurable user-level option may reduce the privilege requirement to lower roles. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Stored cross-site scripting in the NEX-Forms - Ultimate Forms Plugin for WordPress (all versions through 9.2.2) lets unauthenticated attackers persist arbitrary JavaScript via the 'real_val__' form-submission parameter, which later executes in the browser of any user who views the affected page. The flaw is amplified by a design weakness: the submission handler is registered through wp_ajax_nopriv_submit_nex_form with no nonce/CSRF verification, so no authentication or valid session is required to reach the vulnerable sink. There is no public exploit identified at time of analysis and no CISA KEV listing, but the unauthenticated, network-reachable nature makes it a practical mass-exploitation candidate against exposed WordPress sites.
Stored cross-site scripting in the NEX-Forms - Ultimate Forms Plugin for WordPress (all versions through 9.2.2) lets unauthenticated attackers persist arbitrary JavaScript via the '_name[]' array parameter, which then runs in the browser of any user who views the injected page. The flaw is notable because the plugin's own wp_kses() allow-list (NEXForms_allowed_tags()) deliberately whitelists <script>, <iframe src/srcdoc>, and JS event handlers, so the normal output-filtering layer provides no protection. No public exploit identified at time of analysis; the issue was reported by Wordfence and carries a CVSS 7.2 with a changed scope.
Stored Cross-Site Scripting in NEX-Forms WordPress plugin versions ≤9.1.11 allows unauthenticated remote attackers to inject malicious JavaScript through crafted POST parameter key names during form submission. Exploitation requires no authentication (CVSS PR:N) and persists across page loads, affecting any user viewing injected content. The CVSS vector indicates changed scope (S:C), meaning attackers can impact resources beyond the vulnerable component's security scope. No active exploitation confirmed via CISA KEV at time of analysis, but WordPress XSS vulnerabilities typically see rapid weaponization once disclosed.
CVE-2026-1947 is an Insecure Direct Object Reference vulnerability in NEX-Forms WordPress plugin (versions ≤9.1.9) that allows unauthenticated remote attackers to overwrite arbitrary form entries without any authentication. The vulnerability has a CVSS score of 7.5 and while not currently in KEV or having public POCs, it represents a significant data integrity risk for WordPress sites using this forms plugin.
Second-order SQL injection in NEX-Forms - Ultimate Forms Plugin for WordPress (versions through 9.2.4) enables authenticated attackers with admin-level access to extract arbitrary data from the WordPress database by abusing insufficient escaping on the 'additional_params' parameter. The attack is staged: a malicious payload is first stored via the submission_report2 AJAX handler, which notably lacks a nonce check and whose required capability can be configured down to subscriber-level, then the injection fires when an administrator triggers a CSV export. No public exploit or active exploitation has been confirmed at time of analysis, but the privilege-downgrade path on the AJAX handler meaningfully complicates the PR:H framing of the official CVSS vector.
Time-based blind SQL injection in NEX-Forms Ultimate Forms Plugin for WordPress through version 9.1.12 allows authenticated administrators to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'table' parameter. The vulnerability requires administrator-level access and is not actively exploited in public records, but poses significant risk to multi-admin WordPress installations where admin accounts may be compromised or untrusted.
The NEX-Forms Ultimate Forms Plugin for WordPress contains a missing capability check vulnerability in the deactivate_license() function, allowing authenticated attackers with Subscriber-level privileges to deactivate the plugin license without proper authorization. This authorization bypass affects all versions up to and including 9.1.9 and has a CVSS score of 4.3 (Low severity), indicating limited direct impact but meaningful privilege escalation concerns for multi-user WordPress installations.