CVE-2026-13040: NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'realval' parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The submission endpoint is registered via wpajaxnoprivsubmitnexform with no nonce verification, making it fully accessible to unauthenticated attackers without any CSRF token.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NEX-Forms – Ultimate Forms Plugin for WordPressto a version that resolves this vulnerability.Fixed in 9.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13040?
The severity of CVE-2026-13040 is high, with a score of 7.2.
How does CVE-2026-13040 affect the NEX-Forms WordPress plugin?
CVE-2026-13040 allows unauthenticated stored cross-site scripting through the 'real_val__' parameter due to insufficient input sanitization.
What versions of the NEX-Forms plugin are affected by CVE-2026-13040?
CVE-2026-13040 affects all versions of the NEX-Forms plugin up to and including 9.2.2.
How can I fix CVE-2026-13040 in my WordPress installation?
To fix CVE-2026-13040, update the NEX-Forms plugin to a version beyond 9.2.2 that addresses this vulnerability.
Is user authentication necessary to exploit CVE-2026-13040?
No, CVE-2026-13040 can be exploited without authentication, allowing unauthenticated attackers to exploit the vulnerability.