CVE-2026-12142: NEX-Forms Stored XSS Vulnerability – Unauthenticated Arbitrary Script Injection

Technical summary

NEX-Forms versions up to 9.2.2 fail to properly sanitize input in the '_name[]' array parameter before storing it in the database, resulting in stored XSS. The vulnerability chains with a flawed output escaping implementation where NEXForms_allowed_tags() constructs an allowlist that explicitly permits <script>, <iframe src/srcdoc>, onClick, onBlur, onChange, and related JS event handlers. This allowlist is passed to wp_kses() output filtering, but because the dangerous tags and attributes are explicitly permitted, wp_kses() does not strip them. An unauthenticated attacker can craft a malicious form submission with JavaScript payloads in the '_name[]' parameter; the payload is stored unescaped and renders as executable code in the page DOM.

Business impact

Compromise of any website running vulnerable NEX-Forms versions exposes site visitors to arbitrary script execution in their browsers. Attackers can steal session cookies, capture form data, redirect users to phishing sites, inject cryptocurrency miners, or modify page content to damage brand reputation. If the site collects sensitive information—customer data, payment details, login credentials—those become accessible to attackers. The attack requires no special privileges and affects both public-facing forms and backend WordPress admin interfaces where the plugin may be used.

Affected systems

NEX-Forms – Ultimate Forms Plugin for WordPress in all versions up to and including 9.2.2 is vulnerable. Any WordPress installation running this plugin within that version range is at risk, regardless of other security measures. This includes sites that may have the plugin inactive or only partially deployed, since the vulnerability exists in the core plugin code. Organizations should verify their current NEX-Forms version against the vendor's release notes to confirm whether they are patched.

Exploitability

Exploitability is high. The attack vector is network-based, requires no authentication or user privileges, and the conditions for successful exploitation are minimal (AC=Low, UI=None). An attacker simply submits a form with a crafted '_name[]' parameter containing JavaScript. No special interaction from the victim is required at injection time—the script executes automatically whenever anyone visits the page containing the injected form. The unauthenticated attack surface is very broad, making this trivial for attackers to weaponize.

Remediation

Update NEX-Forms to a patched version released after 9.2.2. Verify the patch version against the official NEX-Forms changelog and WordPress plugin repository. Until patching is possible, consider temporarily disabling the NEX-Forms plugin and moving active forms to a different, security-reviewed plugin, or placing the affected form pages behind authentication. Additionally, review server-side form submissions for any injected payloads in historical logs and consider clearing form submission data that may contain malicious code.

Patch guidance

Consult the NEX-Forms official WordPress plugin page and vendor security advisories for the patched version number and release date. Apply the patch as soon as testing confirms compatibility with your WordPress version and other plugins. If patching is delayed, prioritize disabling the plugin in production environments. Test the patch in a staging environment first to confirm no regressions in form functionality. After patching, audit any saved form data for signs of injection attacks.

Detection guidance

Monitor for stored XSS patterns in NEX-Forms database tables and submission logs, specifically looking for <script>, <iframe>, and JS event handler syntax in '_name[]' parameter values. Review WordPress admin audit logs for form creation or modification during the vulnerable period. Use Web Application Firewall (WAF) rules to block or flag requests containing <script>, onclick=, and other executable patterns in form parameters. Check page source of published forms for unexpected <script> or <iframe> tags. Consider deploying Content Security Policy (CSP) headers to reduce XSS impact, though this does not remediate the underlying vulnerability.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.2), network accessibility, lack of authentication requirements, and cross-site impact. The explicit design of the plugin's allowlist to permit dangerous HTML and JavaScript constructs indicates a fundamental security misunderstanding, not a minor oversight. The stored nature of the XSS means every visitor to an injected form is at risk, and the attack chain is trivial to execute. Any organization running vulnerable versions should treat this as a critical patch.

Risk score, explained

CVSS 3.1 score of 7.2 (HIGH) reflects: attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and scope changed (S:C) meaning the impact extends beyond the vulnerable component to affected resources. The vulnerability provides low confidentiality impact (C:L) via session theft and low integrity impact (I:L) via page modification, but no availability impact (A:N). The scope change and lack of authentication elevate this above moderate severity, justifying HIGH classification.

Frequently asked questions