Security Alert Summary
The NEX-Forms – Ultimate Forms Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to and including 9.2.2. Insufficient input sanitization and output escaping of the _name[] array parameter allows unauthenticated attackers to inject HTML and JavaScript that will execute when a user views an injected page. Built-in output filtering does not mitigate the issue because the plugin’s allow-list permits <script>, certain <iframe> attributes, and JavaScript event handlers.
CVE Details
- CVE ID: CVE-2026-12142
- Affected component: NEX-Forms – Ultimate Forms Plugin for WordPress
- Affected versions: All versions up to and including 9.2.2
- Published: July 1, 2026 11:16:24 AM UTC
- Last modified: July 1, 2026 1:56:17 PM UTC
- CVSS v3.1: Base score 7.2 (HIGH) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting issue introduced by insufficient input sanitization and inadequate output escaping of the _name[] array parameter. An unauthenticated attacker can supply payloads that are stored by the plugin and later rendered in pages viewed by other users.
The report notes that the plugin attempts an output filtering pass using wp_kses(), but this does not prevent exploitation because the plugin exposes a custom allow-list function NEXForms_allowed_tags() that explicitly permits <script>, <iframe src/srcdoc>, and JavaScript event handler attributes such as onClick, onBlur, and onChange. As a result, dangerous script content can persist and execute in the context of pages where the stored content is displayed.
Impact is limited to the ability to execute attacker-controlled scripts in the context of affected pages. The attacker-supplied scripts can perform actions available to a page viewer, such as reading content visible to that user or performing actions within the user interface that the victim’s privileges allow, but the report does not claim remote code execution of the server or direct takeover of the WordPress installation.
How This Could Impact Your Website
In a realistic scenario, an unauthenticated attacker could submit a malicious payload through a NEX-Forms field using the _name[] parameter. That payload could be stored and later rendered on a page viewed by different users:
- The site owner or an administrator views an injected entry or page and the script runs in their browser context.
- Internal staff or editors who preview or manage form submissions may have scripts execute in their session, potentially exposing data visible in the browser or enabling actions they could perform while logged in.
- External contributors or site visitors who view the affected page could also execute attacker scripts, which could be used to harvest information visible to them, such as internal user email addresses listed on pages, increasing the risk of targeted phishing or social engineering.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is made available by the vendor.
- Until you can update, limit exposure by reviewing where NEX-Forms stores and renders submitted content and restricting access to pages that display form data.
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level users and those who can submit or render form content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and logs for unusual form submissions, unexpected content changes, or other anomalous behavior.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/includes/classes/class.db.php#L2660
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/includes/classes/class.db.php#L2809
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/includes/classes/class.functions.php#L2343
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/main.php#L2660
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/main.php#L2720
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/main.php#L2903
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.db.php#L2660
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.db.php#L2809
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.functions.php#L2343
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php#L2660
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php#L2720
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php#L2903
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fnex-forms-express-wp-form-builder/tags/9.2.2&new_path=%2Fnex-forms-express-wp-form-builder/tags/9.2.3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/da235dea-4884-4e6a-a8b8-65d34f050684?source=cve
