# CVE-2026-13040: Webaways NEX-Forms Stored XSS in real_val__ parameter

Source: https://junglewise.ai/threats/cve-2026-13040-webaways-nex-forms-stored-xss-in-real-val-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-13040 · Severity: high · CVSS 7.2 · Published 2026-07-03

NEX-Forms, a popular form-building plugin for WordPress, contains a security flaw that allows unauthorized individuals to inject malicious scripts into website pages. This occurs because the plugin does not properly check information submitted through its forms. If exploited, an attacker could steal user session data or redirect visitors to malicious websites whenever they view the affected pages.

Technologies: [Webaways NEX-Forms – Ultimate Forms Plugin for WordPress](https://junglewise.ai/threats/technologies/nex-forms-ultimate-forms-plugin-for-wordpress). Vendors: [Webaways](https://junglewise.ai/threats/vendors/webaways).

## Quick answers

**Is CVE-2026-13040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13040 being exploited in the wild.

**How severe is CVE-2026-13040?** High severity, with a CVSS score of 7.2, published 3 July 2026.

**Which products and versions are affected?** Webaways NEX-Forms – Ultimate Forms Plugin for WordPress up to, and including, 9.2.2.

**Is there a fix for CVE-2026-13040?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13040 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13040?** Check whether you run Webaways NEX-Forms – Ultimate Forms Plugin for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The NEX-Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'real_val__' parameter. The vulnerability is accessible via the 'wp_ajax_nopriv_submit_nex_form' AJAX action, which lacks nonce verification, allowing unauthenticated attackers to submit malicious payloads without a CSRF token. When these payloads are later viewed by other users (such as administrators reviewing form submissions), the injected scripts execute. This affects all versions up to and including 9.2.2.

## Affected products

- webaways NEX-Forms – Ultimate Forms Plugin for WordPress up to, and including, 9.2.2

## Timeline

- 2026-07-03: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/includes/classes/class.functions.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/includes/classes/class.functions.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.11/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.functions.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/includes/classes/class.functions.php)

## Related threats

- [Webaways NEX-Forms authorization bypass in form entries](https://junglewise.ai/threats/cve-2026-9017-webaways-nex-forms-authorization-bypass-in-form-entries)
- [webaways NEX-Forms Stored XSS via _name[] parameter](https://junglewise.ai/threats/cve-2026-12142-webaways-nex-forms-stored-xss-via-name-parameter)
- [Webaways NEX-Forms WordPress plugin authorization bypass](https://junglewise.ai/threats/cve-2026-12404-webaways-nex-forms-wordpress-plugin-authorization-bypass)