Webaways vulnerabilities
We track 6 vulnerabilities in Webaways products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Webaways vulnerabilities
- 7.2 High severity
NEX-Forms – Ultimate Forms Plugin for WordPress: Improper Neutralization of Input During Web Page Generation
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it
- 8.1 High severity
NEX-Forms – Ultimate Forms Plugin for WordPress: Improper Limitation of a Pathname to a Restricted Directory
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and pa
- 7.2 High severity
NEX-Forms – Ultimate Forms Plugin for WordPress: Improper Neutralization of Input During Web Page Generation
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This ma
- 7.2 High severity
NEX-Forms – Ultimate Forms Plugin for WordPress: Improper Neutralization of Input During Web Page Generation
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This mak
- 7.2 High severity
NEX-Forms – Ultimate Forms Plugin for WordPress: Improper Neutralization of Input During Web Page Generation
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submit_nex_form() function in versions up to, and including, 9.1.11 due to insufficient input sanitization
- 7.5 High severity
NEX-Forms – Ultimate Forms Plugin for WordPress: Authorization Bypass Through User-Controlled Key
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.9 via the submit_nex_form() function due to missing validation on a user controlled key. This m