NEX-Forms – Ultimate Forms Plugin for WordPress vulnerabilities

Product

NEX-Forms – Ultimate Forms Plugin for WordPress

by webaways · last CVE Oct 29, 2026

CVEs

On KEV

8.1

Max CVSS

New 30D

Vulnerabilities21 In the news0 Timeline

Severity mix

Critical 0High 6Medium 15Low 0

Severity

All severities21 Critical0 High6 Medium15 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add NEX-Forms – Ultimate Forms Plugin for WordPress to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-4208	6.3	0%	May 8	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function Affected: through 8.9.1
CVE-2025-3468	5.4	0%	May 8	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting Affected: through 8.9.1
CVE-2026-9017	5.3	0%	Jul 11	NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action Affected: through 9.2.2
CVE-2026-12404	5.3	0%	Jun 27	NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class Affected: through 9.2.2
CVE-2025-15510	5.3	0%	Jan 31	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure Affected: through 9.1.8
CVE-2024-13498	5.3	0%	Mar 12	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure Affected: through 8.8.1
CVE-2026-75961	4.9	1%	Sep 18	NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter Affected: through 9.3.0
CVE-2026-15602	4.9	0%	Aug 16	NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter Affected: through 9.2.4
CVE-2026-7046	4.9	0%	May 15	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter Affected: through 9.1.12
CVE-2025-10185	4.9	0%	Oct 11	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection Affected: through 9.1.6
CVE-2024-10862	4.9	1%	Dec 25	NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection Affected: through 8.7.15
CVE-2026-1948	4.3	0%	Mar 14	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license Affected: through 9.1.9
CVE-2024-1130	4.3	1%	Feb 1	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() Affected: through 8.5.6
CVE-2024-1129	4.3	1%	Feb 1	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() Affected: through 8.5.6
CVE-2024-0907	4.3	1%	Feb 1	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() Affected: through 8.5.6