WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in NEX-Forms – Ultimate Forms Plugin for WordPress

Build beautiful responsive forms for WordPress. Contact forms, surveys, quizzes, booking forms, payments, popups & more with NEX-Forms...

34Reported vulnerabilities
9.8Highest CVSS score
9.2.5Latest version
6,000+Active installs

What to do now

Update NEX-Forms – Ultimate Forms Plugin for WordPress to 9.2.5 or later. 34 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 13, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2015-9452 Critical 9.8 2.4% Before 4.6.1 4.6.1 October 7, 2019
WF-2e88aa9e-6d1d-44ba-8d63-2f4d4161bc9e Critical 9.8 — Before 3.4 3.4 April 21, 2015
CVE-2026-15450 High 8.1 0.4% 0 to 9.2.3 (inclusive) 9.2.4 August 1, 2026
CVE-2026-1947 High 7.5 0.3% 0 to 9.1.9 (inclusive) 9.1.10 March 16, 2026
CVE-2026-57668 High 7.2 0.3% 9.2.2 and earlier 9.2.3 July 10, 2026
CVE-2026-13040 High 7.2 0.5% 0 to 9.2.2 (inclusive) 9.2.3 July 3, 2026
CVE-2026-12142 High 7.2 0.5% 0 to 9.2.2 (inclusive) 9.2.3 July 1, 2026
CVE-2026-10525 High 7.2 0.3% 9.2.2 and earlier 9.2.3 June 26, 2026
CVE-2026-5063 High 7.2 0.2% 0 to 9.1.11 (inclusive) 9.1.12 May 3, 2026
CVE-2025-69324 High 7.2 0.2% 9.1.7 and earlier 9.1.8 February 4, 2026
CVE-2024-37512 Medium 6.4 0.3% 8.5.10 and earlier 8.6.1 July 5, 2024
CVE-2024-25593 Medium 6.4 0.3% 8.5.5 and earlier 8.5.6 February 12, 2024
CVE-2025-4208 Medium 6.3 0.3% 8.9.2 and earlier 8.9.2 May 8, 2025
CVE-2025-69326 Medium 6.1 0.2% 9.1.7 and earlier 9.1.8 February 9, 2026
CVE-2024-47389 Medium 6.1 0.3% 8.7.3 and earlier 8.7.4 September 30, 2024
CVE-2023-50838 Medium 5.5 0.6% 8.5.5 and earlier 8.5.6 December 21, 2023
CVE-2026-9017 Medium 5.3 0.5% 0 to 9.2.2 (inclusive) 9.2.3 July 11, 2026
CVE-2026-12404 Medium 5.3 0.5% 0 to 9.2.2 (inclusive) 9.2.3 June 27, 2026
CVE-2025-15510 Medium 5.3 0.3% 0 to 9.1.8 (inclusive) 9.1.9 January 31, 2026
CVE-2025-3468 Medium 5.4 0.2% Before 8.9.2 8.9.2 May 8, 2025
CVE-2024-13498 Medium 5.3 0.4% 0 to 8.8.1 (inclusive) 8.8.2 March 12, 2025
CVE-2024-10862 Medium 4.9 0.6% 8.7.13 and earlier 8.7.16 December 25, 2024
CVE-2024-53808 Medium 4.9 0.6% 8.7.8 and earlier 8.7.9 December 2, 2024
CVE-2026-15602 Medium 4.9 0.3% 0 to 9.2.4 (inclusive) 9.2.5 August 16, 2026
CVE-2026-7046 Medium 4.9 0.4% 0 to 9.1.12 (inclusive) 9.1.13 May 15, 2026
CVE-2025-10185 Medium 4.9 0.3% 0 to 9.1.6 (inclusive) 9.1.7 October 11, 2025
CVE-2021-34676 Medium 4.3 1.8% 7.8.7 and earlier 7.8.8 July 19, 2021
CVE-2025-14803 Medium 4.4 0.3% 9.1.7 and earlier 9.1.8 December 19, 2025
CVE-2024-1130 Medium 4.3 0.6% Before 8.5.7 8.5.7 February 29, 2024
CVE-2024-1129 Medium 4.3 0.6% Before 8.5.7 8.5.7 February 29, 2024
CVE-2024-0907 Medium 4.3 0.6% Before 8.5.7 8.5.7 February 29, 2024
CVE-2026-1948 Medium 4.3 0.2% 0 to 9.1.9 (inclusive) 9.1.10 March 16, 2026
CVE-2025-49399 Medium 4.3 0.2% 9.1.3 and earlier 9.1.4 August 20, 2025
CVE-2023-52120 Medium 4.3 0.2% 8.5.2 and earlier 8.5.5 December 28, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.