https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-4208.htmlhttps://patchthecve.com/cve/CVE-2025-4208.htmlWed, 17 Jun 2026 09:32:46 +0000MEDIUM 6.3: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes ihttps://patchthecve.com/cve/CVE-2025-3468.htmlhttps://patchthecve.com/cve/CVE-2025-3468.htmlWed, 17 Jun 2026 09:20:00 +0000MEDIUM 6.4: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the clean_html and form_fields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it pohttps://patchthecve.com/cve/CVE-2024-10862.htmlhttps://patchthecve.com/cve/CVE-2024-10862.htmlWed, 17 Jun 2026 06:56:35 +0000MEDIUM 4.9: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'search_params' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on thehttps://patchthecve.com/cve/CVE-2024-53808.htmlhttps://patchthecve.com/cve/CVE-2024-53808.htmlWed, 17 Jun 2026 08:09:19 +0000HIGH 8.5: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows SQL Injection.This issue affects NEX-Forms: from n/a through <= 8.7.8.https://patchthecve.com/cve/CVE-2024-47389.htmlhttps://patchthecve.com/cve/CVE-2024-47389.htmlWed, 17 Jun 2026 07:57:00 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through <= 8.7.3.https://patchthecve.com/cve/CVE-2024-37512.htmlhttps://patchthecve.com/cve/CVE-2024-37512.htmlWed, 17 Jun 2026 07:38:30 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.10.