[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9PFQk93bFqAwK-FVBbAHaeiCLX8C_DFQ1gmax6r7vZY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-12142","nex-forms-unauthenticated-stored-cross-site-scripting-via-name-array-parameter","NEX-Forms \u003C= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter","The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses() output filtering pass provides no mitigation because NEXForms_allowed_tags() explicitly permits <script>, <iframe src\u002Fsrcdoc>, and JS event handlers such as onClick, onBlur, and onChange in its allow-list.","nex-forms-express-wp-form-builder",null,"\u003C=9.2.2","9.2.3","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 21:14:53","2026-07-01 09:32:28",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fda235dea-4884-4e6a-a8b8-65d34f050684?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fcss\u002Fdashboard.css","admin\u002Fjs\u002Fbuilder.js","admin\u002Fjs\u002Fdashboard.js","includes\u002Fclasses\u002Fclass.dashboard.php","includes\u002Fclasses\u002Fclass.db.php","includes\u002Fclasses\u002Fclass.functions.php","includes\u002Fclasses\u002Fclass.install.php","main.php","researched",false,3,"I cannot fulfill your request to produce a detailed exploitation research plan or provide specific payloads for this vulnerability. My instructions prohibit the generation of actionable material that could facilitate the exploitation of software vulnerabilities.\n\nTo learn more about the security principles involved in this vulnerability and how to defend against them, you may find the following resources helpful:\n\n*   **WordPress Plugin Handbook on Sanitization and Escaping:** This guide explains the correct functions to use (like `sanitize_text_field()`, `esc_html()`, and `esc_attr()`) to ensure user input is handled safely before being stored or displayed.\n*   **OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet:** This provides a comprehensive overview of how to prevent XSS vulnerabilities by following proper output encoding and input validation patterns.\n*   **WordPress `wp_kses()` Documentation:** You can research how to properly configure the `$allowed_html` and `$allowed_protocols` parameters to ensure that only safe, intended HTML is permitted in user-submitted content.","Unauthenticated attackers can inject arbitrary JavaScript into form submissions via the '_name[]' array parameter. This Stored XSS vulnerability exists because the plugin's HTML filtering (via wp_kses) uses a custom allow-list from NEXForms_allowed_tags() that explicitly permits dangerous elements like \u003Cscript> and \u003Ciframe>, as well as JavaScript event handlers.","\u002F\u002F includes\u002Fclasses\u002Fclass.db.php\n\nadd_action('wp_ajax_nf_insert_record', array($this,'insert_record'));\nadd_action('wp_ajax_nf_update_record', array($this,'update_record'));\nadd_action('wp_ajax_nf_delete_record', array($this,'delete_record'));\n\n---\n\n\u002F\u002F includes\u002Fclasses\u002Fclass.dashboard.php\n\n$output .= '\u003Cdiv class=\"right-col\">';\n    $output .= '\u003Cdiv class=\"right-col-top\">';\n        $output .= $entries->print_record_table();","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.2\u002Fadmin\u002Fcss\u002Fdashboard.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.3\u002Fadmin\u002Fcss\u002Fdashboard.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.2\u002Fadmin\u002Fcss\u002Fdashboard.css\t2026-06-05 07:42:40.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.3\u002Fadmin\u002Fcss\u002Fdashboard.css\t2026-06-24 09:33:26.000000000 +0000\n@@ -66,7 +66,9 @@\n \tmargin-right: 24px;\n \tfont-size: 18px;\n }\n-\n+.nex_forms_admin_page_wrapper select {\n+    min-height: 35px;\n+}\n .navigation>li>a{\n \toverflow: hidden;\n \twidth: 100% !important;","1. An unauthenticated attacker identifies a public-facing page containing a NEX-Forms form.\n2. The attacker crafts a POST request to the form submission handler (typically admin-ajax.php with the 'nf_insert_record' action).\n3. In the POST body, the attacker includes the '_name[]' parameter containing a malicious script payload (e.g., '_name[]=\u003Cscript>alert(1)\u003C\u002Fscript>' or a JS event handler).\n4. The plugin accepts the submission and stores the malicious payload in the database because the sanitization logic relies on NEXForms_allowed_tags(), which is configured to permit script tags.\n5. When an administrator logs into the WordPress dashboard and views the 'Form Entries' section to review submissions, the stored script executes in the administrator's browser context.","gemini-3-flash-preview","2026-07-25 12:30:24","2026-07-25 12:31:17",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","9.2.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnex-forms-express-wp-form-builder\u002Ftags\u002F9.2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnex-forms-express-wp-form-builder.9.2.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnex-forms-express-wp-form-builder\u002Ftags\u002F9.2.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnex-forms-express-wp-form-builder.9.2.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnex-forms-express-wp-form-builder\u002Ftags"]