Unknown Nex-Forms vulnerabilities

3 CVEs affecting Unknown Nex-Forms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106166, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-14803, published 2026-01-09. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow…
CVE-2026-10525, published 2026-07-17. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site…
CVE-2026-106166, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to…