CVE-2026-12142: NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name[]' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpkses() output filtering pass provides no mitigation because NEXFormsallowedtags() explicitly permits <script>, <iframe src/srcdoc>, and JS event handlers such as onClick, onBlur, and onChange in its allow-list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/NEX-Forms – Ultimate Forms Pluginto a version that resolves this vulnerability.Fixed in 9.2.2 - Configuration
Update the plugin’s output sanitization logic so NEXForms_allowed_tags() no longer permits <script>, <iframe src/srcdoc>, or JavaScript event handlers (onClick/onBlur/onChange).
WordPress plugin NEX-Forms – Ultimate Forms Plugin NEXForms_allowed_tags() allow-list = Remove explicit permissions for <script>, <iframe src/srcdoc>, and JS event handlers such as onClick, onBlur, and onChange
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12142?
CVE-2026-12142 has a severity rating of high with a score of 7.2.
How do I fix CVE-2026-12142?
To fix CVE-2026-12142, update the NEX-Forms plugin to a version later than 9.2.2 where the vulnerability is patched.
What type of vulnerability is associated with CVE-2026-12142?
CVE-2026-12142 is associated with a stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-12142?
Users of NEX-Forms Ultimate Forms Plugin for WordPress versions up to and including 9.2.2 are affected by CVE-2026-12142.
What is the risk posed by CVE-2026-12142?
CVE-2026-12142 poses a risk of unauthenticated attackers exploiting the vulnerability to inject malicious scripts.