CVE-2026-5063 HIGH

CVE-2026-5063: NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names

Vendor Webaways
Product NEX-Forms – Ultimate Forms Plugin for WordPress
Weakness CWE-79 · XSS
Published May 3, 2026
Last update May 4, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submit_nex_form() function in versions up to, and including, 9.1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Explanation of Vulnerability in Simple Terms

02Summary

NEX-Forms versions up to 9.1.11 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into the site. The vulnerability can affect multiple users and compromise site integrity. Site administrators should update to a version newer than 9.1.11 as soon as possible.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that executes in visitors' browsers and affects other users on the site.

Potential impact on your site

04Site Impact

Visitors may be redirected, have their sessions hijacked, or see malicious content injected into your site pages.

Conditions required to exploit

05Prerequisites

No authentication or user interaction required; attacker can exploit this remotely over the network.

Key dates

06Disclosure timeline

May 3, 2026 CVE published
May 4, 2026 Record updated