Advisories · Technology

NEX-Forms.

Every CVE that names NEX-Forms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-106166 CVE record

CVSS 5.3 Medium

NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
- NEX-Forms
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-10525 CVE record

CVSS 6.1 Medium

NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission
- NEX-Forms
- Cross-site scripting (XSS)
Not analysed yet 17 Jul 2026
CVE-2025-14803 CVE record

CVSS 6.8 Medium

Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSS
- NEX-Forms
- Cross-site scripting (XSS)
Not analysed yet 9 Jan 2026
CVE-2023-0439 CVE record

NEX-Forms < 8.4.4 - Authenticated Stored XSS
- NEX-Forms
Not analysed yet 17 Jul 2023
CVE-2023-2114 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

NEX-Forms < 8.4 - Admin+ SQL Injection
- NEX-Forms
- SQL injection
Not analysed yet 8 May 2023
CVE-2023-0272 CVE record

CVSS 5.4 Medium

NEX-Forms < 8.3.3 - Contributor+ Stored XSS
- NEX-Forms
Not analysed yet 27 Mar 2023
CVE-2021-24705 CVE record

NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF
- NEX-Forms
Not analysed yet 13 Dec 2021