---
id: "CVE-2026-96767"
kind: "vulnerability"
aliases: ["CVE-2026-96767"]
title: "NEX-Forms WordPress plugin: unauthenticated stored script injection via type parameter"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nex-forms-express-wp-form-builder", "fixed": ["9.3.3"], "affected": "<= 9.3.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["nex-forms", "package", "unauthenticated", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["patched-9.3.3", "plugin-not-installed"]
published_at: "2026-10-29T12:17:14+00:00"
first_seen_at: "2026-10-29T12:24:39+00:00"
updated_at: "2026-10-29T12:27:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96767", "first_seen_at": "2026-10-29T12:24:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T12:27:12+00:00"}]
---

# NEX-Forms WordPress plugin: unauthenticated stored script injection via type parameter

NEX-Forms (WordPress) <= 9.3.2 fails to sanitize the 'type' parameter, letting an unauthenticated attacker store script that runs when a user opens the injected page. Any WordPress site with the plugin active at <= 9.3.2 should be checked; sites without it or on 9.3.3+ can skip. Fixed in 9.3.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:nex-forms-express-wp-form-builder affected <= 9.3.2 fixed 9.3.3

## How to check

In WordPress admin > Plugins, check the NEX-Forms version; affected if <= 9.3.2. Or run: wp plugin get nex-forms-express-wp-form-builder --field=version

## Fix

Update NEX-Forms (nex-forms-express-wp-form-builder) to 9.3.3 or later.

## Timeline

- 2026-10-29T12:24:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96767
- 2026-10-29T12:27:12+00:00 analyst — Patchstack (third-party, linked) says <=9.3.2 unauth XSS, fixed 9.3.3, CVSS 7.1, mitigation rule exists; Wordfence CNA CVSS 7.2. Wordfence/NVD/wordpress.org changelog not retrievable, so nothing marked verified. Not known exploited. Whether 'type' is exposed by default is unconfirmed. WPSEC-2026-1306 (submission-data XSS, also fixed 9.3.3) may be related.

## Documents

- [advisory] Patchstack: NEX-Forms <= 9.3.2 unauthenticated stored XSS (CVE-2026-96767) https://patchstack.com/database/wordpress/plugin/nex-forms-express-wp-form-builder/vulnerability/wordpress-nex-forms-ultimate-forms-plugin-for-wordpress-plugin-9-3-2-unauthenticated-stored-cross-site-scripting-vulnerability

## From the sources

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_