5.3
Medium
CVE-2026-106166 The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation…
Description
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NEX-Forms 9.2 | 9.2.1 → < 9.3.1 | 9.3.1 |
Other CVEs of NEX-Forms
The 7 CVEs of NEX-Forms →
CVE-2026-10525
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and…
6.1
Medium
CVE-2025-14803
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings
6.8
Medium
CVE-2023-0439
The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site…
Not rated
CVE-2023-2114
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user…
7.2
High