PT-2026-54618 · WordPress · Nex-Forms

Anthony Cihan + 1 · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-12142

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the name[] array parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. The wp kses() output filtering is ineffective because the NEXForms allowed tags() function explicitly permits <script>, <iframe src/srcdoc>, and JavaScript event handlers such as onClick, onBlur, and onChange in its allow-list.

Recommendations Update NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.2.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-12142

Affected Products

Nex-Forms

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2026-12142 · Security Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php#L2903 · Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/main.php#L2660 · Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php#L2660 · Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.db.php#L2809 · Note
• https://t.me/CVEtracker/58568 · Telegram Post
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php#L2720 · Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/includes/classes/class.functions.php#L2343 · Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.db.php#L2660 · Note
• https://t.me/cveNotify/182242 · Telegram Post
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/includes/classes/class.db.php#L2660 · Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.10/main.php#L2720 · Note
• https://twitter.com/VulmonFeeds/status/2072296564169596996 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/da235dea-4884-4e6a-a8b8-65d34f050684?source=cve · Note
• https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.functions.php#L2343 · Note