CVE-2026-10525

MediumCVSS 6.1/10Last modified Jul 17, 2026

Description

The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2026
Last modified
Jul 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1052504.3A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decodCVE-2026-1052516.3A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/codingCVE-2026-1052537.3A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /CVE-2026-1052546.3A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.phCVE-2026-1052565.3The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking agCVE-2026-1052572.7The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customCVE-2026-105265.8The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticateCVE-2026-1052604.3The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted aCVE-2026-1052616.8The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.CVE-2026-1052628.0The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a CVE-2026-1052634.7A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file applicationCVE-2026-1052655.3A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to ca