Advisories · Technology
webaways NEX-Forms – Ultimate Forms Plugin for WordPress.
Every CVE that names webaways NEX-Forms – Ultimate Forms Plugin for WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- SQL injection
- CVSS 4.9 Medium
NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- SQL injection
- CVSS 8.1 High
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Path traversal
- CVSS 5.3 Medium
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 7.2 High
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 4.9 Medium
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- SQL injection
- CVSS 7.2 High
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Cross-site scripting (XSS)
- CVSS 7.5 High
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 4.3 Medium
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 5.3 Medium
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 4.9 Medium
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- SQL injection
- CVSS 6.4 Medium
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Code injection
- CVSS 5.3 Medium
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Information disclosure
- CVSS 4.9 Medium
NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- SQL injection
- CVSS 5.3 Medium
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 5.3 Medium
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 5.3 Medium
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control
- CVSS 6.3 Medium
NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Broken access control