WordPress plugin

NEX-Forms – Ultimate Forms Plugin for WordPress security & vulnerabilities

Q: Does NEX-Forms – Ultimate Forms Plugin for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 44 known vulnerabilities in NEX-Forms – Ultimate Forms Plugin for WordPress: 2 critical, 12 high, 30 medium. None are known to affect version null.

Q: How do I check which version of NEX-Forms – Ultimate Forms Plugin for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent NEX-Forms – Ultimate Forms Plugin for WordPress vulnerability?

CVE-2026-96767, published Oct 28, 2026: NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header. Severity: High (CVSS 7.2).

Q: Is any NEX-Forms – Ultimate Forms Plugin for WordPress vulnerability listed in CISA KEV?

No. None of the known NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities is currently listed in the CISA KEV catalog.

nex-forms-express-wp-form-builder— active installsLast vulnerability Oct 28, 2026

No known unpatched vulnerabilities in the latest version

All 44 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

44Known vulnerabilities

Critical2
High12
Medium30
Low0

Vulnerabilities per year

All NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities

NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Unauthenticated Stored Cross-Site Scripting via Content-Type Header ≤9.3.2Update to 9.3.3	CVE-2026-96767	Oct 28
High8.1	Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter ≤9.2.3Update to 9.2.4	CVE-2026-15450	Jul 31
High7.2	Unauthenticated Stored Cross-Site Scripting ≤9.2.2Update to 9.2.3	CVE-2026-57668	Jul 10
High7.2	Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter ≤9.2.2Update to 9.2.3	CVE-2026-13040	Jul 02
High7.2	Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter ≤9.2.2Update to 9.2.3	CVE-2026-12142	Jun 30
High7.2	Unauthenticated Stored Cross-Site Scripting ≤9.2.2Update to 9.2.3	CVE-2026-10525	Jun 26
High7.2	Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names ≤9.1.11Update to 9.1.12	CVE-2026-5063	May 02
High7.5	Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id ≤9.1.9Update to 9.1.10	CVE-2026-1947	Mar 14
High7.2	Unauthenticated Stored Cross-Site Scripting ≤9.1.7Update to 9.1.8	CVE-2025-69324	Feb 04
High7.2	Authenticated (Administrator+) SQL Injection ≤8.3.3Update to 8.4	CVE-2023-2114	Apr 17, 2023
High7.2	Authenticated (Administrator+) SQL Injection ≤7.9.6Update to 7.9.7	CVE-2022-3142	Aug 1, 2022
High8.8	Cross-Site Request Forgery to Cross-Site Scripting ≤8.4.2Update to 8.4.3	CVE-2021-24705	Nov 14, 2021
Critical9.8	SQL Injection <4.6.1Update to 4.6.1	CVE-2015-9452	Jul 16, 2015
Critical9.8	SQL Injection <3.4Update to 3.4	—	Apr 21, 2015

High7.2
Unauthenticated Stored Cross-Site Scripting via Content-Type Header
≤9.3.2Update to 9.3.3
CVE-2026-96767Oct 28
High8.1
Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
≤9.2.3Update to 9.2.4
CVE-2026-15450Jul 31
High7.2
Unauthenticated Stored Cross-Site Scripting
≤9.2.2Update to 9.2.3
CVE-2026-57668Jul 10
High7.2
Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
≤9.2.2Update to 9.2.3
CVE-2026-13040Jul 02
High7.2
Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
≤9.2.2Update to 9.2.3
CVE-2026-12142Jun 30
High7.2
Unauthenticated Stored Cross-Site Scripting
≤9.2.2Update to 9.2.3
CVE-2026-10525Jun 26
High7.2
Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
≤9.1.11Update to 9.1.12
CVE-2026-5063May 02
High7.5
Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
≤9.1.9Update to 9.1.10
CVE-2026-1947Mar 14
High7.2
Unauthenticated Stored Cross-Site Scripting
≤9.1.7Update to 9.1.8
CVE-2025-69324Feb 04
High7.2
Authenticated (Administrator+) SQL Injection
≤8.3.3Update to 8.4
CVE-2023-2114Apr 17, 2023
High7.2
Authenticated (Administrator+) SQL Injection
≤7.9.6Update to 7.9.7
CVE-2022-3142Aug 1, 2022
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
≤8.4.2Update to 8.4.3
CVE-2021-24705Nov 14, 2021
Critical9.8
SQL Injection
<4.6.1Update to 4.6.1
CVE-2015-9452Jul 16, 2015
Critical9.8
SQL Injection
<3.4Update to 3.4
2e88aa9e-6d1d-44ba-8d63-2f4d4161bc9eApr 21, 2015

NEX-Forms – Ultimate Forms Plugin for WordPress: common questions

Does NEX-Forms – Ultimate Forms Plugin for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 44 known vulnerabilities in NEX-Forms – Ultimate Forms Plugin for WordPress: 2 critical, 12 high, 30 medium. None are known to affect version null.

How do I check which version of NEX-Forms – Ultimate Forms Plugin for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent NEX-Forms – Ultimate Forms Plugin for WordPress vulnerability?

CVE-2026-96767, published Oct 28, 2026: NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header. Severity: High (CVSS 7.2).

Is any NEX-Forms – Ultimate Forms Plugin for WordPress vulnerability listed in CISA KEV?

No. None of the known NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities is currently listed in the CISA KEV catalog.