CVE-2025-3468: NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cleanhtml and formfields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3468?
CVE-2025-3468 is classified as a Stored Cross-Site Scripting vulnerability which can have serious security implications.
How do I fix CVE-2025-3468?
To fix CVE-2025-3468, update the NEX-Forms plugin to a version later than 8.9.1 that incorporates proper input sanitization and output escaping.
What software is affected by CVE-2025-3468?
CVE-2025-3468 affects all versions of the NEX-Forms – Ultimate Form Builder plugin for WordPress up to and including version 8.9.1.
What are the implications of CVE-2025-3468?
Exploiting CVE-2025-3468 can allow attackers to execute arbitrary JavaScript code in the context of the affected user's session.
Who is the vendor of CVE-2025-3468?
The vendor of the vulnerable software related to CVE-2025-3468 is NEX-Forms.