NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
Description
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses() output filtering pass provides no mitigation because NEXForms_allowed_tags() explicitly permits <script>, <iframe src/srcdoc>, and JS event handlers such as onClick, onBlur, and onChange in its allow-list.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=9.2.2What Changed in the Fix
Changes introduced in v9.2.3
Source Code
WordPress.org SVNI cannot fulfill your request to produce a detailed exploitation research plan or provide specific payloads for this vulnerability. My instructions prohibit the generation of actionable material that could facilitate the exploitation of software vulnerabilities. To learn more about the security pri…
Show full research plan
I cannot fulfill your request to produce a detailed exploitation research plan or provide specific payloads for this vulnerability. My instructions prohibit the generation of actionable material that could facilitate the exploitation of software vulnerabilities.
To learn more about the security principles involved in this vulnerability and how to defend against them, you may find the following resources helpful:
- WordPress Plugin Handbook on Sanitization and Escaping: This guide explains the correct functions to use (like
sanitize_text_field(),esc_html(), andesc_attr()) to ensure user input is handled safely before being stored or displayed. - OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet: This provides a comprehensive overview of how to prevent XSS vulnerabilities by following proper output encoding and input validation patterns.
- WordPress
wp_kses()Documentation: You can research how to properly configure the$allowed_htmland$allowed_protocolsparameters to ensure that only safe, intended HTML is permitted in user-submitted content.
Summary
Unauthenticated attackers can inject arbitrary JavaScript into form submissions via the '_name[]' array parameter. This Stored XSS vulnerability exists because the plugin's HTML filtering (via wp_kses) uses a custom allow-list from NEXForms_allowed_tags() that explicitly permits dangerous elements like <script> and <iframe>, as well as JavaScript event handlers.
Vulnerable Code
// includes/classes/class.db.php add_action('wp_ajax_nf_insert_record', array($this,'insert_record')); add_action('wp_ajax_nf_update_record', array($this,'update_record')); add_action('wp_ajax_nf_delete_record', array($this,'delete_record')); --- // includes/classes/class.dashboard.php $output .= '<div class="right-col">'; $output .= '<div class="right-col-top">'; $output .= $entries->print_record_table();
Security Fix
@@ -66,7 +66,9 @@ margin-right: 24px; font-size: 18px; } - +.nex_forms_admin_page_wrapper select { + min-height: 35px; +} .navigation>li>a{ overflow: hidden; width: 100% !important;
Exploit Outline
1. An unauthenticated attacker identifies a public-facing page containing a NEX-Forms form. 2. The attacker crafts a POST request to the form submission handler (typically admin-ajax.php with the 'nf_insert_record' action). 3. In the POST body, the attacker includes the '_name[]' parameter containing a malicious script payload (e.g., '_name[]=<script>alert(1)</script>' or a JS event handler). 4. The plugin accepts the submission and stores the malicious payload in the database because the sanitization logic relies on NEXForms_allowed_tags(), which is configured to permit script tags. 5. When an administrator logs into the WordPress dashboard and views the 'Form Entries' section to review submissions, the stored script executes in the administrator's browser context.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.