CVE-2023-2114: Basixonline Nex-Forms

High severity, CVSS 7.2. EPSS: 44.6% chance of exploitation in the next 30 days.

The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query.

Affected products

• Basixonline Nex-Forms: before 8.4 (fixed in 8.4)

Published 2023-05-08. Last modified 2026-06-17.