5.3
Moyenne
CVE-2026-106166 The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation…
Description
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| NEX-Forms 9.2 | 9.2.1 → < 9.3.1 | 9.3.1 |
Autres CVE de NEX-Forms
Les 7 CVE de NEX-Forms →
CVE-2026-10525
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and…
6.1
Moyenne
CVE-2025-14803
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings
6.8
Moyenne
CVE-2023-0439
The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site…
Non notée
CVE-2023-2114
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user…
7.2
Élevée