Skip to content
PluginCanary

NEX-Forms - Ultimate Forms Plugin for WordPress

by Basix · 5,000+ active installs · Checked 3 Nov 2026
Healthy5 Warnings

Healthy: vulnerability published 28 Oct 2026, fixed in 9.3.3.

81/ 100 Canary Score
Sub-scores for NEX-Forms - Ultimate Forms Plugin for WordPress
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 9.3.3. Update to version 9.3.3 or later.28 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 14 Oct 2026, fixed in 9.3.1. Update to version 9.3.1 or later.14 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 4 Oct 2026, fixed in 9.3.2. Update to version 9.3.2 or later.4 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 17 Sep 2026, fixed in 9.3.1. Update to version 9.3.1 or later.17 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 15 Aug 2026, fixed in 9.2.5. Update to version 9.2.5 or later.15 Aug 2026Evidence
  • InfoSEC-327 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
webaways14 Apr 2014 to 20 Oct 2026, 710 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
15 days ago
Releases, 24 months
38
Tested up to
7.1 current
Requires PHP
7.2 supported 8.2+
Releases per quarter for NEX-Forms - Ultimate Forms Plugin for WordPress
Q1 20242
Q2 20241
Q3 20246
Q4 20246
Q1 20256
Q2 20256
Q3 20257
Q4 20251
Q1 20262
Q2 20266
Q3 20264
Q4 20261

Last release 20 Oct 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
28 Oct 2026NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header7.2<= 9.3.29.3.30
14 Oct 2026NEX-Forms – Ultimate Forms Plugin for WordPress 9.2.1 - 9.3.0 - Unauthenticated Insecure Direct Object Reference5.39.2.1 to 9.3.09.3.10
4 Oct 2026NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 9.3.19.3.20
17 Sep 2026NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter4.9<= 9.3.09.3.10
15 Aug 2026NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter4.9<= 9.2.49.2.50
31 Jul 2026NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter8.1<= 9.2.39.2.40
10 Jul 2026NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action5.3<= 9.2.29.2.30
10 Jul 2026NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.2.29.2.30
2 Jul 2026NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter7.2<= 9.2.29.2.30
30 Jun 2026NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter7.2<= 9.2.29.2.30
26 Jun 2026NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class5.3<= 9.2.29.2.30
26 Jun 2026NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.2.29.2.30
14 May 2026NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter4.9<= 9.1.129.1.130
2 May 2026NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names7.2<= 9.1.119.1.120
14 Mar 2026NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id7.5<= 9.1.99.1.100
13 Mar 2026NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license4.3<= 9.1.99.1.100
9 Feb 2026NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting6.1<= 9.1.79.1.80
4 Feb 2026NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.1.79.1.80
30 Jan 2026NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3<= 9.1.89.1.90
19 Dec 2025Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 9.1.79.1.80
10 Oct 2025NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection4.9<= 9.1.69.1.70
20 Aug 2025NEX-Forms <= 9.1.3 - Cross-Site Request Forgery4.3<= 9.1.39.1.40
7 May 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function6.3<= 8.9.18.9.20
7 May 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting6.4<= 8.9.18.9.20
11 Mar 2025NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure5.3<= 8.8.18.8.20

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.1 from 135 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star104
4 star2
3 star0
2 star2
1 star27

Momentum

5,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for NEX-Forms - Ultimate Forms Plugin for WordPress
4 May 2026384
11 May 20261,372
18 May 20261,015
25 May 20261,325
1 Jun 20261,251
8 Jun 2026629
15 Jun 2026553
22 Jun 20261,165
29 Jun 2026721
6 Jul 2026901
13 Jul 2026600
20 Jul 2026543
27 Jul 20261,351
3 Aug 20261,029
10 Aug 20261,291
17 Aug 20261,045
24 Aug 2026683
31 Aug 20261,300
7 Sep 2026668
14 Sep 20261,599
21 Sep 2026826
28 Sep 2026678
5 Oct 2026843
12 Oct 2026766
19 Oct 20261,704
26 Oct 20261,337
2 Nov 2026106

Weekly downloads over the last 4 weeks are 3% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - JotformScore 91 · 20,000+Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & MoreScore 91 · 10,000+Contact Form Clean and SimpleScore 91 · 7,000+Formzu WPScore 91 · 3,000+Woorise - Forms, Quizzes & GiveawaysScore 91 · 1,000+

Facts

Version9.3.3
AuthorBasix
Added14 Apr 2014
Last updated20 Oct 2026
Active installs5,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHP7.2
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms, form builder, survey forms, contact forms, wordpress forms

Other plugins by this author: NEX-Forms ADD ON - Form Themes, NEX-Forms ADD ON - Super Select, NEX-Forms ADD ON - Digital Signatures, NEX-Forms ADD ON - Mailchimp, NEX-Forms ADD ON - Zapier Integration, NEX-Forms ADD ON - GetRepsonse

Questions

Is NEX-Forms - Ultimate Forms Plugin for WordPress still maintained?

NEX-Forms - Ultimate Forms Plugin for WordPress was last updated on 20 Oct 2026. Its Canary status is Healthy.

Is NEX-Forms - Ultimate Forms Plugin for WordPress safe?

NEX-Forms - Ultimate Forms Plugin for WordPress has no open unpatched vulnerabilities on record. 27 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns NEX-Forms - Ultimate Forms Plugin for WordPress?

The wordpress.org author is Basix. Recent committers: webaways, plugin-master. We have recorded no ownership change.

What can I use instead of NEX-Forms - Ultimate Forms Plugin for WordPress?

Plugins in the same category with a higher Canary Score: Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - Jotform, Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & More, Contact Form Clean and Simple, Formzu WP, Woorise - Forms, Quizzes & Giveaways.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue