Medium
CVE-2026-96607
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 42
Reset filters
Medium
CVE-2026-75961
NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
Medium
CVE-2026-15602
NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
High
CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
Medium
CVE-2026-9017
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
High
CVE-2026-57668
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-13040
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
High
CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
Medium
CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
High
CVE-2026-10525
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
High
CVE-2026-5063
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
High
CVE-2026-1947
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
Medium
CVE-2026-1948
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
Medium
CVE-2025-69326
NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting
High
CVE-2025-69324
NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-15510
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14803
Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-10185
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-49399
NEX-Forms <= 9.1.3 - Cross-Site Request Forgery
Medium
CVE-2025-4208
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function
Medium
CVE-2025-3468
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting
Medium
CVE-2024-13498
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2024-10862
NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.