SQL Injection Vulnerability in NEX-Forms Plugin for WordPress

CVE-2025-10185

What is CVE-2025-10185?

The NEX-Forms – Ultimate Forms Plugin for WordPress is susceptible to SQL Injection attacks due to insufficient input validation of the 'orderby' parameter within the action nf_load_form_entries. This vulnerability exists in all versions prior to 9.1.6. Authenticated users with Administrator-level access can manipulate SQL queries to extract sensitive data from the database, endangering the security of the site. Moreover, this could potentially be exploited by lower-level users if granted access by site administrators.

References