{
 "id": "WPSEC-2026-1306",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1306/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1306/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1306/index.md",
 "title": "NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data",
 "description": "The NEX-Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data, such as the MIME type of uploaded files, in all versions up to, and including, 9.3.2. This is due to submission records being written into the admin record tables without escaping (for example raw comma-separated items and 'data:image' values placed in an image src attribute) and to the HTML allowlist that filters the dashboard output allowing the script tag. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when an administrator views the submission or file upload records in the plugin dashboard.",
 "plugin": {
  "slug": "nex-forms-express-wp-form-builder",
  "name": "NEX-Forms – Ultimate Forms Plugin for WordPress",
  "full_name": "NEX-Forms – Ultimate Forms Plugin for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/nex-forms-express-wp-form-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nex-forms-express-wp-form-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nex-forms-express-wp-form-builder"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.3.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.3.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.3.3",
 "remediation": "Update to 9.3.3 or later.",
 "fix_released": "2026-10-20T05:39:56+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:28.574429+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1306/",
  "https://plugins.svn.wordpress.org/nex-forms-express-wp-form-builder/tags/9.3.3/",
  "https://wordpress.org/plugins/nex-forms-express-wp-form-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nex-forms-express-wp-form-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}