# NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data

- **ID:** WPSEC-2026-1306
- **Plugin:** NEX-Forms – Ultimate Forms Plugin for WordPress (`nex-forms-express-wp-form-builder`), https://wordpress.org/plugins/nex-forms-express-wp-form-builder/
- **Affected versions:** all versions before 9.3.3
- **Fixed in:** 9.3.3 (Update to 9.3.3 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/nex-forms-express-wp-form-builder
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1306/

## Description

The NEX-Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data, such as the MIME type of uploaded files, in all versions up to, and including, 9.3.2. This is due to submission records being written into the admin record tables without escaping (for example raw comma-separated items and 'data:image' values placed in an image src attribute) and to the HTML allowlist that filters the dashboard output allowing the script tag. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when an administrator views the submission or file upload records in the plugin dashboard.

## References

- https://wpsec.com/vuln/WPSEC-2026-1306/
- https://plugins.svn.wordpress.org/nex-forms-express-wp-form-builder/tags/9.3.3/
- https://wordpress.org/plugins/nex-forms-express-wp-form-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1306/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.