GCVE - cpe:2.3:a:unknown:nex-forms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:nex-forms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Nex Forms (`46300bc9-a3d6-543f-b043-129c350e99f2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-10525`	vulnerable	2026-07-29 00:20:52.017973	NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries. Published: 2026-07-17T06:00:01.678Z Updated: 2026-07-17T14:50:27.413Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/d1e191e6-ff5b-4cb8-9b12-8ae73cf0d2f0/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-14803`	vulnerable	2026-06-08 07:06:35.152466	Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSS The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting. Published: 2026-01-09T06:00:13.484Z Updated: 2026-01-09T15:16:05.818Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/219af0e7-3d8b-4405-8005-b8969a370b0b/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-2114`	vulnerable	2026-06-08 06:02:41.444864	NEX-Forms < 8.4 - Admin+ SQL Injection The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query. Published: 2023-05-08T13:58:08.740Z Updated: 2025-02-04T20:02:29.849Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d https://github.com/SchmidAlex/nex-forms_SQL-Injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0439`	vulnerable	2026-06-08 05:52:04.955052	NEX-Forms < 8.4.4 - Authenticated Stored XSS The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature. Published: 2023-07-17T13:29:58.934Z Updated: 2024-10-30T14:02:35.287Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0272`	vulnerable	2026-06-08 05:52:04.652205	NEX-Forms < 8.3.3 - Contributor+ Stored XSS The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Published: 2023-03-27T15:37:41.482Z Updated: 2025-02-19T16:01:14.072Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/047b50c0-0eb3-4371-9e5d-3778fdafc66b	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24705`	vulnerable	2026-06-08 05:30:39.047404	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.