PT-2025-41642 · WordPress · Nex-Forms – Ultimate Forms Plugin For Wordpress

Đức Tài + 1 · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-10185

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions through 9.1.6

Description The software is susceptible to SQL Injection through the orderby parameter within the nf load form entries action. Insufficient input sanitization and inadequate SQL query preparation allow authenticated attackers with Administrator-level access or higher to inject additional SQL queries, potentially extracting sensitive database information. Lower-level users may also be able to exploit this if granted access by a site administrator.

Recommendations Update NEX-Forms – Ultimate Forms Plugin for WordPress to a version later than 9.1.6.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10185

Affected Products

Nex-Forms – Ultimate Forms Plugin For Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10185 · Security Note
• https://twitter.com/VulmonFeeds/status/1976998889510027518 · Twitter Post
• https://t.me/cveNotify/138319 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e68d47e7-9a42-4a77-aefa-fe130500cbd3?source=cve · Note
• https://twitter.com/CVEnew/status/1976914832432501180 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3365585/nex-forms-express-wp-form-builder/trunk/includes/classes/class.db.php · Note
• https://plugins.svn.wordpress.org/nex-forms-express-wp-form-builder/tags/9.1.4/includes/classes/class.db.php#2527 · Note