webaways vulnerabilities
22 published CVEs name webaways among the affected products.
- Published CVEs
- 22
- Last 12 months
- 13
- Critical
- 0
- Known exploited
- 0
Critical 0High 6Medium 16Low 0Not scored 0
CVEs per yearBy the year they were published
- 20231
- 20244
- 20254
- 202613
Newest CVEs
- CVE-2026-96767
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
High7.2 - CVE-2026-75961
NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
Medium4.9 - CVE-2026-15602
NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
Medium4.9 - CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
High8.1 - CVE-2026-9017
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
Medium5.3 - CVE-2026-13040
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
High7.2 - CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
High7.2 - CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
Medium5.3 - CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
Medium4.9 - CVE-2026-5063
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
webaways · NEX-Forms – Ultimate Forms Plugin for WordPress
High7.2