CVE-2026-5063
Stored XSS in NEX-Forms Ultimate Forms WordPress Plugin
Publication date: 2026-05-03
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nex-forms | ultimate_forms_plugin | to 9.1.11 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 9.1.11. This vulnerability occurs because the plugin does not properly sanitize or escape input from POST parameter key names in the submit_nex_form() function. As a result, an unauthenticated attacker can inject malicious web scripts that are stored and later executed whenever a user accesses the affected page.
How can this vulnerability impact me? :
This vulnerability allows attackers to execute arbitrary scripts in the context of the affected website without authentication. This can lead to theft of user credentials, session hijacking, defacement of the website, or distribution of malware to visitors. Because the attack is stored, the malicious script persists and affects every user who visits the injected page.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to inject arbitrary web scripts via stored cross-site scripting (XSS). This can lead to unauthorized access to user data or session hijacking when users access the injected pages.
Such unauthorized access or data exposure could potentially violate data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.
However, the provided information does not explicitly state the impact on compliance with these standards.