NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data
- ID
- WPSEC-2026-1306
- Plugin
- NEX-Forms – Ultimate Forms Plugin for WordPress (nex-forms-express-wp-form-builder)
- Affected
- all versions before 9.3.3
- Remediation
- Update to 9.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- NEX-Forms – Ultimate Forms Plugin for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The NEX-Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data, such as the MIME type of uploaded files, in all versions up to, and including, 9.3.2. This is due to submission records being written into the admin record tables without escaping (for example raw comma-separated items and 'data:image' values placed in an image src attribute) and to the HTML allowlist that filters the dashboard output allowing the script tag. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when an administrator views the submission or file upload records in the plugin dashboard.
References
- https://wpsec.com/vuln/WPSEC-2026-1306/
- https://plugins.svn.wordpress.org/nex-forms-express-wp-form-builder/tags/9.3.3/
- https://wordpress.org/plugins/nex-forms-express-wp-form-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS