Search
Search Results (7 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-4208 | 1 Basixonline | 1 Nex-forms | 2026-04-22 | 6.3 Medium |
| The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions that meet specific constraints (static methods or global functions accepting a single array parameter). | ||||
| CVE-2025-3468 | 1 Basixonline | 1 Nex-forms | 2026-04-21 | 6.4 Medium |
| The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the clean_html and form_fields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2020-36670 | 1 Basixonline | 1 Nex-forms | 2026-04-08 | 6.3 Medium |
| The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber level permissions and above to invoke these functions which can be used to perform actions like modify form submission records, deleting files, sending test emails, modifying plugin settings, and more. | ||||
| CVE-2015-9452 | 1 Basixonline | 1 Nex-forms | 2025-01-15 | 9.8 Critical |
| The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter. | ||||
| CVE-2021-34676 | 1 Basixonline | 1 Nex-forms | 2024-11-21 | 7.5 High |
| Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. | ||||
| CVE-2021-34675 | 1 Basixonline | 1 Nex-forms | 2024-11-21 | 7.5 High |
| Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. | ||||
| CVE-2021-24705 | 1 Basixonline | 1 Nex-forms | 2024-11-21 | 4.8 Medium |
| The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them | ||||
Page 1 of 1.