NEX-Forms – Ultimate Forms Plugin for WordPress

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 9% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ Jose Gonzalez

   5mo ago

   I really wanted to like this plugin, but the current behavior is disappointing. After installing it from the WordPress repository, it immediately requires a license key to activate, so it cannot be used right away in a standard WordPress setup. It also no longer works as a fully standalone form builder within WordPress, which limits how it can be used in real projects. I also tried contacting support through the official channel but did not receive a response. Just something to be aware of if you’re expecting a working form plugin immediately after installation.

   Read on wp.org ↗
2. ★★★★★ Helios06fr

   6mo ago

   The most comprehensive plugin that lets you create a form perfectly tailored to your needs. Even without being an expert, I was able to create 19 forms on my website myself, each one adapted to the type of service I offer. The design is also impressive; see for yourself. It allows you to display a modern and elegant design that integrates seamlessly with your brand guidelines. In short, for me, despite all the available plugins, it’s number one, by far, because it evolves with the times. This form plugin will undoubtedly boost your brand awareness, and at a very reasonable price considering the constant and evolving updates. Look no further, visit my website [URL removed by moderators] and see for yourself. This topic was modified 5 months ago by Helios06fr. This topic was modified 5 months ago by threadi.

   Read on wp.org ↗
3. ★★★★★ tecne

   8mo ago

   After encountering a problem with my Envato license purchase, I contacted support and they quickly resolved the issue, and my plugin is now active again. Regarding the plugin itself, it’s one of the most comprehensive I’ve found, with no limitations based on the number of queries and many additional plugins that enhance the tool. Thank you very much for your assistance, Paul.

   Read on wp.org ↗
4. ★★★★★ jumling

   8mo ago

   We use this for a number of things:Multi-step forms, the ability to export all submissions/reports, and e-signatures. Support is great, Paul is very responsive. We had an issue today after publishing a staging website and licence problem, Paul was on it – and fixed within the same day.

   Read on wp.org ↗
5. ★★★★★ miks6227

   8mo ago

   NEX-Form Basix plugin is very helpful. Support exelent This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227.

   Read on wp.org ↗
6. ★★★★★ Tegid

   9mo ago

   I encountered some issues with the PRO plugin on my site, and the developer was very responsive and helpful. Thank you!

   Read on wp.org ↗
7. ★★★★★ smartbox1

   10mo ago

   The Next Forms plugin works very well and their support is top-notch.They are always ready to help and solve any problem we may have, even if it’s not derived from Next Forms.

   Read on wp.org ↗
8. ★★★★★ Twilight Tech

   10mo ago

   I have known this plugin for more than 4 years through the Themeforest website, the price for me is affordable, and easier than Formidable plugin and more options than the Ninja plugin and the important point you can do what the plugin team offers, about the support team they are amazing and they solve any issue or knowledge missed in this plugin, I appreciate the developer team for what developed, thank you verey muchand wish to them more success.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 9.2.3 IMPROVED: Added security measures to prevent potential Cross Site Scripting (XSS). IMPROVED: Added additional security measures for CSV/Excel Exports. IMPROVED: Added additional security measures for Email Previews. IMPR 9.2.3
2. — Version 9.2.2 IMPROVED: WP 7.x compatibility. NEW: Added an additional Reply-to for user confirmation emails. NEW: Enabled Smart Data Tags to be used in PayPal Item Names. NEW: Enabled Smart Data Tags to be used in PDF Creator File Na 9.2.2
3. — Version 9.2 NEW: Complete redevelopment of the Add-ons admin page NEW: Install add-ons directly from your NEX-Forms add-ons admin page. NEW: Activate add-ons directly from your NEX-Forms add-ons admin page. NEW: Deactivate add-ons d 9.2
4. — Version 9.1.3 NEW: Complete redevelopment of the Form analytics admin page NEW: Analytical data showing submission in a Geographical chart. NEW: Analytical data showing top countries by submissions. NEW: Analytical data showing top pe 9.1.3
5. — Version 9.1.2 NEW: Complete redevelopment of the submission reporting feature including a clean an more user friendly backend UI. NEW: Create and save reports. Now you can open a report without having to regenerate it. NEW: Quick Expo 9.1.2
6. — Version 8.6.2 NEW: Full redevelopment of Dropdown Selects and Multi-selects NEW: Searchable Dropdown Selects and Multi-selects – Enable/Disable a search for dropdown selects and multi-selects options. NEW: Optgroups in the Select and 8.6.2

40 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.9 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter ↗
   2026-08-15 CVE-2026-15602 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 9.2.4 Patched in 9.2.5
2. High · 8.1 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter ↗
   2026-07-31 CVE-2026-15450 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 9.2.3 Patched in 9.2.4
3. Medium · 5.3 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action ↗
   2026-07-10 CVE-2026-9017 Missing Authorization Affects <= 9.2.2 Patched in 9.2.3
4. High · 7.2 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-10 CVE-2026-57668 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.2.2 Patched in 9.2.3
5. High · 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter ↗
   2026-07-02 CVE-2026-13040 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.2.2 Patched in 9.2.3
6. High · 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter ↗
   2026-06-30 CVE-2026-12142 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.2.2 Patched in 9.2.3
7. Medium · 5.3 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class ↗
   2026-06-26 CVE-2026-12404 Missing Authorization Affects <= 9.2.2 Patched in 9.2.3
8. High · 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-26 CVE-2026-10525 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.2.2 Patched in 9.2.3
9. Medium · 4.9 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter ↗
   2026-05-14 CVE-2026-7046 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 9.1.12 Patched in 9.1.13
10. High · 7.2 NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names ↗
    2026-05-02 CVE-2026-5063 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.1.11 Patched in 9.1.12
11. High · 7.5 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id ↗
    2026-03-14 CVE-2026-1947 Authorization Bypass Through User-Controlled Key Affects <= 9.1.9 Patched in 9.1.10
12. Medium · 4.3 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license ↗
    2026-03-13 CVE-2026-1948 Missing Authorization Affects <= 9.1.9 Patched in 9.1.10
13. Medium · 6.1 NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting ↗
    2026-02-09 CVE-2025-69326 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.1.7 Patched in 9.1.8
14. High · 7.2 NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-02-04 CVE-2025-69324 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.1.7 Patched in 9.1.8
15. Medium · 5.3 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure ↗
    2026-01-30 CVE-2025-15510 Missing Authorization Affects <= 9.1.8 Patched in 9.1.9
16. Medium · 4.4 Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-12-19 CVE-2025-14803 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.1.7 Patched in 9.1.8
17. Medium · 4.9 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection ↗
    2025-10-10 CVE-2025-10185 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 9.1.6 Patched in 9.1.7
18. Medium · 4.3 NEX-Forms <= 9.1.3 - Cross-Site Request Forgery ↗
    2025-08-20 CVE-2025-49399 Cross-Site Request Forgery (CSRF) Affects <= 9.1.3 Patched in 9.1.4
19. Medium · 6.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function ↗
    2025-05-07 CVE-2025-4208 Improper Control of Generation of Code ('Code Injection') Affects <= 8.9.1 Patched in 8.9.2
20. Medium · 6.4 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting ↗
    2025-05-07 CVE-2025-3468 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 8.9.1 Patched in 8.9.2
21. Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure ↗
    2025-03-11 CVE-2024-13498 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 8.8.1 Patched in 8.8.2
22. Medium · 4.9 NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection ↗
    2024-12-24 CVE-2024-10862 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 8.7.15 Patched in 8.7.16
23. Medium · 4.9 NEX-Forms – Ultimate Form Builder <= 8.7.8 - Authenticated (Administrator+) SQL Injection ↗
    2024-12-02 CVE-2024-53808 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 8.7.8 Patched in 8.7.9
24. Medium · 6.1 NEX-Forms – Ultimate Form Builder <= 8.7.3 - Reflected Cross-Site Scripting ↗
    2024-09-30 CVE-2024-47389 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 8.7.3 Patched in 8.7.4
25. Medium · 6.4 NEX-Forms – Ultimate Form Builder <= 8.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-07-05 CVE-2024-37512 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 8.5.10 Patched in 8.6.1
26. Medium · 6.4 NEX-Forms – Ultimate Form Builder <= 8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2024-02-12 CVE-2024-25593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 8.5.5 Patched in 8.5.6
27. Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() ↗
    2024-01-31 CVE-2024-0907 Missing Authorization Affects <= 8.5.6 Patched in 8.5.7
28. Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() ↗
    2024-01-31 CVE-2024-1129 Missing Authorization Affects <= 8.5.6 Patched in 8.5.7
29. Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() ↗
    2024-01-31 CVE-2024-1130 Missing Authorization Affects <= 8.5.6 Patched in 8.5.7
30. Medium · 4.3 NEX-Forms – Ultimate Form Builder <= 8.5.2 - Cross-Site Request Forgery ↗
    2023-12-28 CVE-2023-52120 Cross-Site Request Forgery (CSRF) Affects <= 8.5.2 Patched in 8.5.5
31. Medium · 5.5 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.5 - Authenticated (Admin+) SQL Injection ↗
    2023-12-21 CVE-2023-50838 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 8.5.5 Patched in 8.5.6
32. Medium · 4.8 NEX-Forms - Ultimate Form Builder <= 8.4.3 - Authenticated Stored Cross-Site Scripting via Form Name ↗
    2023-06-26 CVE-2023-0439 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 8.4.3 Patched in 8.4.4
33. High · 7.2 NEX-Forms <= 8.3.3 - Authenticated (Administrator+) SQL Injection ↗
    2023-04-17 CVE-2023-2114 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 8.3.3 Patched in 8.4
34. Medium · 6.4 NEX-Forms - Ultimate Form Builder <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-02-28 CVE-2023-0272 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 8.3.2 Patched in 8.3.3
35. High · 7.2 NEX-Forms <= 7.9.6 - Authenticated (Administrator+) SQL Injection ↗
    2022-08-01 CVE-2022-3142 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 7.9.6 Patched in 7.9.7
36. High · 8.8 NEX-Forms – Ultimate Form Builder <= 8.4.2 - Cross-Site Request Forgery to Cross-Site Scripting ↗
    2021-11-14 CVE-2021-24705 Cross-Site Request Forgery (CSRF) Affects <= 8.4.2 Patched in 8.4.3
37. Medium · 4.3 NEX-Forms <= 7.8.7 Authorization Bypass ↗
    2021-07-19 CVE-2021-34676 Improper Authorization Affects <= 7.8.7 Patched in 7.8.8
38. Medium · 6.3 NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions ↗
    2020-11-27 CVE-2020-36670 Missing Authorization Affects <= 7.7.1 Patched in 7.8
39. Critical · 9.8 NEX-Forms – Ultimate Form Builder < 4.6.1 - SQL Injection ↗
    2015-07-16 CVE-2015-9452 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.6.1 Patched in 4.6.1
40. Critical · 9.8 NEX-Forms – Ultimate Form Builder – Contact forms and much more < 3.4 - SQL Injection ↗
    2015-04-21 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 3.4 Patched in 3.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-05-27 7K+ → 6K+ down after 1 days in tier
2. 2026-05-26 6K+ → 7K+ up after 1 days in tier
3. 2026-05-25 7K+ → 6K+ down after 92 days in tier
4. 2026-02-22 8K+ → 7K+ down after 74 days in tier
5. 2025-12-10 9K+ → 8K+ down after 109 days in tier
6. 2025-08-23 10K+ → 9K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• NEX-Forms ADD ON – Form Themes 1K+ installs · 3.6★ · 4 shared tags B
• NEX-Forms ADD ON – Zapier Integration 100+ installs · 3.6★ · 4 shared tags B
• NEX-Forms ADD ON – Super Select 1K+ installs · 3.6★ · 3 shared tags B
• Contact Form Generator : Creative form builder for WordPress 800+ installs · 4.3★ · 2 shared tags A
• NEX-Forms ADD ON – Digital Signatures 600+ installs · 3.6★ · 2 shared tags B
• NEX-Forms ADD ON – Mailchimp 200+ installs · 3.6★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for NEX-Forms – Ultimate Forms Plugin for WordPress into a readme, a review or a deck. It updates itself.

NEX-Forms – Ultimate Forms Plugin for WordPress: 6K+ active installs, 4.1★ (133 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/nex-forms-express-wp-form-builder