CVE-2026-124270 · Package
NO FIX YET · SEE WHAT TO DO
NEX-Forms, a WordPress form builder plugin by Basix, does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can get a logged-in user to open a crafted link and run script in their browser session.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the NEX-Forms WordPress plugin (nex-forms-express-wp-form-builder) at affected versions, through 9.3.3 per NVD. Exposure depends on the plugin's pages reflecting unescaped input; sites without the plugin are not affected. The sources do not say which pages or parameters are involved.
Not affected if plugin-not-installed
Who cares nex-forms, self-hosted, wordpress
nex-forms-express-wp-form-builder on the server9.3.3 are named as affected in the sourceImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.