Plugin security history

NEX-Forms – Ultimate Forms Plugin for WordPress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 39 vulnerability records associated with NEX-Forms – Ultimate Forms Plugin for WordPress, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

39Total records

2Critical

11High

26Medium

0Low

0Informational

39Patched records

0Currently marked unpatched

2015-04-21First disclosure

2026-07-31Latest disclosure

38 of 39CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	2	2 records
2020	1	1 records
2021	2	2 records
2022	1	1 records
2023	5	5 records
2024	8	8 records
2025	6	6 records
2026	14	14 records

Severity Breakdown

Severity	Records	Share
Critical	2	5.1%
High	11	28.2%
Medium	26	66.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records35.9%

First: 2023. Latest: 2026.

Missing Authorization

10 records25.6%

First: 2020. Latest: 2026.

SQL Injection

9 records23.1%

First: 2015. Latest: 2026.

CSRF

3 records7.7%

First: 2021. Latest: 2025.

Information Disclosure

1 record2.6%

First: 2025. Latest: 2025.

Other

1 record2.6%

First: 2025. Latest: 2025.

Path Traversal

1 record2.6%

First: 2026. Latest: 2026.

Patch Status

Patched: 39
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

9.2.4
9.2.3
9.1.13
9.1.12
9.1.10
9.1.9
9.1.8
9.1.7
9.1.4
8.9.2
8.8.2
8.7.16
8.7.9
8.7.4
8.6.1
8.5.7
8.5.5
8.5.6
8.4.4
8.4
8.3.3
7.9.7
8.4.3
7.8.8
7.8
4.6.1
3.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-9.2.3`	NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter	July 31, 2026	9.2.4	High
`*-9.2.2`	NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action	July 10, 2026	9.2.3	Medium
`*-9.2.2`	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting	July 10, 2026	9.2.3	High
`*-9.2.2`	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter	July 2, 2026	9.2.3	High
`*-9.2.2`	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter	June 30, 2026	9.2.3	High
`*-9.2.2`	NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class	June 26, 2026	9.2.3	Medium
`*-9.2.2`	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting	June 26, 2026	9.2.3	High
`*-9.1.12`	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter	May 14, 2026	9.1.13	Medium
`*-9.1.11`	NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names	May 2, 2026	9.1.12	High
`*-9.1.9`	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id	March 14, 2026	9.1.10	High
`*-9.1.9`	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license	March 13, 2026	9.1.10	Medium
`*-9.1.7`	NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting	February 9, 2026	9.1.8	Medium
`*-9.1.7`	NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting	February 4, 2026	9.1.8	High
`*-9.1.8`	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure	January 30, 2026	9.1.9	Medium
`*-9.1.7`	Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting	December 19, 2025	9.1.8	Medium
`*-9.1.6`	NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection	October 10, 2025	9.1.7	Medium
`*-9.1.3`	NEX-Forms <= 9.1.3 - Cross-Site Request Forgery	August 20, 2025	9.1.4	Medium
`*-8.9.1`	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function	May 7, 2025	8.9.2	Medium
`*-8.9.1`	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting	May 7, 2025	8.9.2	Medium
`*-8.8.1`	NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure	March 11, 2025	8.8.2	Medium
`*-8.7.15`	NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection	December 24, 2024	8.7.16	Medium
`*-8.7.8`	NEX-Forms – Ultimate Form Builder <= 8.7.8 - Authenticated (Administrator+) SQL Injection	December 2, 2024	8.7.9	Medium
`*-8.7.3`	NEX-Forms – Ultimate Form Builder <= 8.7.3 - Reflected Cross-Site Scripting	September 30, 2024	8.7.4	Medium
`*-8.5.10`	NEX-Forms – Ultimate Form Builder <= 8.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 5, 2024	8.6.1	Medium
`*-8.5.5`	NEX-Forms – Ultimate Form Builder <= 8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode	February 12, 2024	8.5.6	Medium

Selected source records

Latest Records

HighCVE-2026-15450

NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter

Published: July 31, 2026

Affected versions: *-9.2.3
Patched versions: 9.2.4

Original Wordfence record

MediumCVE-2026-9017

NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action

Published: July 10, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

HighCVE-2026-57668

NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting

Published: July 10, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

HighCVE-2026-13040

NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter

Published: July 2, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

HighCVE-2026-12142

NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter

Published: June 30, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

MediumCVE-2026-12404

NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class

Published: June 26, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

HighCVE-2026-10525

NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting

Published: June 26, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

MediumCVE-2026-7046

NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter

Published: May 14, 2026

Affected versions: *-9.1.12
Patched versions: 9.1.13

Original Wordfence record

Highest-Severity Records

Critical

NEX-Forms – Ultimate Form Builder – Contact forms and much more < 3.4 - SQL Injection

Published: April 21, 2015

Affected versions: [*, 3.4)
Patched versions: 3.4

Original Wordfence record

CriticalCVE-2015-9452

NEX-Forms – Ultimate Form Builder < 4.6.1 - SQL Injection

Published: July 16, 2015

Affected versions: [*, 4.6.1)
Patched versions: 4.6.1

Original Wordfence record

HighCVE-2021-24705

NEX-Forms – Ultimate Form Builder <= 8.4.2 - Cross-Site Request Forgery to Cross-Site Scripting

Published: November 14, 2021

Affected versions: *-8.4.2
Patched versions: 8.4.3

Original Wordfence record

HighCVE-2026-15450

NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter

Published: July 31, 2026

Affected versions: *-9.2.3
Patched versions: 9.2.4

Original Wordfence record

HighCVE-2026-1947

NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id

Published: March 14, 2026

Affected versions: *-9.1.9
Patched versions: 9.1.10

Original Wordfence record

HighCVE-2026-10525

NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting

Published: June 26, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

HighCVE-2026-13040

NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter

Published: July 2, 2026

Affected versions: *-9.2.2
Patched versions: 9.2.3

Original Wordfence record

HighCVE-2025-69324

NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting

Published: February 4, 2026

Affected versions: *-9.1.7
Patched versions: 9.1.8

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory