CVE-2021-24705: Basixonline Nex-Forms

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them

Affected products

• Basixonline Nex-Forms: up to and including 7.9.4

Published 2021-12-13. Last modified 2026-06-17.