WordPress plugin
NEX-Forms – Ultimate Forms Plugin for WordPress security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 44 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High12
- Medium30
- Low0
All NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting via Content-Type Header
≤9.3.2Update to 9.3.3
- Medium5.39.3.0 - Unauthenticated Insecure Direct Object Reference
9.2.1 – 9.3.0Update to 9.3.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤9.3.1Update to 9.3.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
≤9.3.0Update to 9.3.1
- Medium4.9Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
≤9.2.4Update to 9.2.5
- High8.1Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
≤9.2.3Update to 9.2.4
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
≤9.2.2Update to 9.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤9.2.2Update to 9.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
≤9.2.2Update to 9.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
≤9.2.2Update to 9.2.3
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
≤9.2.2Update to 9.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤9.2.2Update to 9.2.3
- Medium4.9Authenticated (Administrator+) SQL Injection via 'table' Parameter
≤9.1.12Update to 9.1.13
- High7.2Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
≤9.1.11Update to 9.1.12
- High7.5Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
≤9.1.9Update to 9.1.10
- Medium4.3Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
≤9.1.9Update to 9.1.10
- Medium6.1Reflected Cross-Site Scripting
≤9.1.7Update to 9.1.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤9.1.7Update to 9.1.8
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure
≤9.1.8Update to 9.1.9
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤9.1.7Update to 9.1.8
- Medium4.9Authenticated (Admin+) SQL Injection
≤9.1.6Update to 9.1.7
- Medium4.3Cross-Site Request Forgery
≤9.1.3Update to 9.1.4
- Medium6.3Authenticated (Custom) Limited Code Execution via get_table_records Function
≤8.9.1Update to 8.9.2
- Medium6.4Authenticated (Custom) Stored Cross-Site Scripting
≤8.9.1Update to 8.9.2
- Medium5.3Unauthenticated Sensitive Information Exposure
≤8.8.1Update to 8.8.2
- Medium4.9Authenticated (Admin+) SQL Injection
≤8.7.15Update to 8.7.16
- Medium4.9Authenticated (Administrator+) SQL Injection
≤8.7.8Update to 8.7.9
- Medium6.1Reflected Cross-Site Scripting
≤8.7.3Update to 8.7.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤8.5.10Update to 8.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
≤8.5.5Update to 8.5.6
- Medium5.3Missing Authorization via restore_records()
≤8.5.6Update to 8.5.7
- Medium5.3Missing Authorization via set_starred()
≤8.5.6Update to 8.5.7
- Medium5.3Missing Authorization via set_read()
≤8.5.6Update to 8.5.7
- Medium4.3Cross-Site Request Forgery
≤8.5.2Update to 8.5.5
- Medium5.5Authenticated (Admin+) SQL Injection
≤8.5.5Update to 8.5.6
- Medium4.8Ultimate Form Builder <= 8.4.3 - Authenticated Stored Cross-Site Scripting via Form Name
≤8.4.3Update to 8.4.4
- High7.2Authenticated (Administrator+) SQL Injection
≤8.3.3Update to 8.4
- Medium6.4Ultimate Form Builder <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤8.3.2Update to 8.3.3
- High7.2Authenticated (Administrator+) SQL Injection
≤7.9.6Update to 7.9.7
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
≤8.4.2Update to 8.4.3
- Medium4.3NEX-Forms <= 7.8.7 Authorization Bypass
≤7.8.7Update to 7.8.8
- Medium6.3Missing Authorization on Various AJAX Actions
≤7.7.1Update to 7.8
- Critical9.8SQL Injection
<4.6.1Update to 4.6.1
- Critical9.8SQL Injection
<3.4Update to 3.4
NEX-Forms – Ultimate Forms Plugin for WordPress: common questions
Does NEX-Forms – Ultimate Forms Plugin for WordPress have known vulnerabilities?
Yes. VulnCrest Radar lists 44 known vulnerabilities in NEX-Forms – Ultimate Forms Plugin for WordPress: 2 critical, 12 high, 30 medium. None are known to affect version null.
How do I check which version of NEX-Forms – Ultimate Forms Plugin for WordPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent NEX-Forms – Ultimate Forms Plugin for WordPress vulnerability?
CVE-2026-96767, published Oct 28, 2026: NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header. Severity: High (CVSS 7.2).
Is any NEX-Forms – Ultimate Forms Plugin for WordPress vulnerability listed in CISA KEV?
No. None of the known NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities is currently listed in the CISA KEV catalog.