NEX-Forms – Ultimate Forms Plugin for WordPress

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

112 searches this plugin appeared in over the last 90 days, 19 listed. 93 left out as unrelated or noise (years, numbers, stray words). 3 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 24 days ago and a band this size takes about a year or more to cross, so the real count is still just under 6K.

1. ★★★★★ Jose Gonzalez

   7mo ago

   I really wanted to like this plugin, but the current behavior is disappointing. After installing it from the WordPress repository, it immediately requires a license key to activate, so it cannot be used right away in a standard WordPress setup. It also no longer works as a fully standalone form builder within WordPress, which limits how it can be used in real projects. I also tried contacting support through the official channel but did not receive a response. Just something to be aware of if you’re expecting a working form plugin immediately after installation.

   Read on wp.org ↗
2. ★★★★★ Helios06fr

   9mo ago

   The most comprehensive plugin that lets you create a form perfectly tailored to your needs. Even without being an expert, I was able to create 19 forms on my website myself, each one adapted to the type of service I offer. The design is also impressive; see for yourself. It allows you to display a modern and elegant design that integrates seamlessly with your brand guidelines. In short, for me, despite all the available plugins, it’s number one, by far, because it evolves with the times. This form plugin will undoubtedly boost your brand awareness, and at a very reasonable price considering the constant and evolving updates. Look no further, visit my website [URL removed by moderators] and see for yourself. This topic was modified 5 months ago by Helios06fr. This topic was modified 5 months ago by threadi.

   Read on wp.org ↗
3. ★★★★★ tecne

   10mo ago

   After encountering a problem with my Envato license purchase, I contacted support and they quickly resolved the issue, and my plugin is now active again. Regarding the plugin itself, it’s one of the most comprehensive I’ve found, with no limitations based on the number of queries and many additional plugins that enhance the tool. Thank you very much for your assistance, Paul.

   Read on wp.org ↗
4. ★★★★★ jumling

   10mo ago

   We use this for a number of things:Multi-step forms, the ability to export all submissions/reports, and e-signatures. Support is great, Paul is very responsive. We had an issue today after publishing a staging website and licence problem, Paul was on it – and fixed within the same day.

   Read on wp.org ↗
5. ★★★★★ miks6227

   11mo ago

   NEX-Form Basix plugin is very helpful. Support exelent This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227. This topic was modified 7 months ago by miks6227.

   Read on wp.org ↗
6. ★★★★★ Tegid

   11mo ago

   I encountered some issues with the PRO plugin on my site, and the developer was very responsive and helpful. Thank you!

   Read on wp.org ↗
7. ★★★★★ smartbox1

   12mo ago

   The Next Forms plugin works very well and their support is top-notch.They are always ready to help and solve any problem we may have, even if it’s not derived from Next Forms.

   Read on wp.org ↗
8. ★★★★★ Twilight Tech

   12mo ago

   I have known this plugin for more than 4 years through the Themeforest website, the price for me is affordable, and easier than Formidable plugin and more options than the Ninja plugin and the important point you can do what the plugin team offers, about the support team they are amazing and they solve any issue or knowledge missed in this plugin, I appreciate the developer team for what developed, thank you verey muchand wish to them more success.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 9.2.3 IMPROVED: Added security measures to prevent potential Cross Site Scripting (XSS). IMPROVED: Added additional security measures for CSV/Excel Exports. IMPROVED: Added additional security measures for Email Previews. IMPR 9.2.3
2. — Version 9.2.2 IMPROVED: WP 7.x compatibility. NEW: Added an additional Reply-to for user confirmation emails. NEW: Enabled Smart Data Tags to be used in PayPal Item Names. NEW: Enabled Smart Data Tags to be used in PDF Creator File Na 9.2.2
3. — Version 9.2 NEW: Complete redevelopment of the Add-ons admin page NEW: Install add-ons directly from your NEX-Forms add-ons admin page. NEW: Activate add-ons directly from your NEX-Forms add-ons admin page. NEW: Deactivate add-ons d 9.2
4. — Version 9.1.3 NEW: Complete redevelopment of the Form analytics admin page NEW: Analytical data showing submission in a Geographical chart. NEW: Analytical data showing top countries by submissions. NEW: Analytical data showing top pe 9.1.3
5. — Version 9.1.2 NEW: Complete redevelopment of the submission reporting feature including a clean an more user friendly backend UI. NEW: Create and save reports. Now you can open a report without having to regenerate it. NEW: Quick Expo 9.1.2
6. — Version 8.6.2 NEW: Full redevelopment of Dropdown Selects and Multi-selects NEW: Searchable Dropdown Selects and Multi-selects – Enable/Disable a search for dropdown selects and multi-selects options. NEW: Optgroups in the Select and 8.6.2

All 44 disclosed vulnerabilities are patched in the current version (9.3.3). Sites still on an older version should update.

1. Patched High · 7.2 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header ↗
   2026-10-28 CVE-2026-96767 Improper Neutralization of Input During Web Page Generation Affects <= 9.3.2 Patched in 9.3.3
2. Patched Medium · 5.3 NEX-Forms – Ultimate Forms Plugin for WordPress 9.2.1 - 9.3.0 - Unauthenticated Insecure Direct Object Reference ↗
   2026-10-14 CVE-2026-106166 Authorization Bypass Through User-Controlled Key Affects 9.2.1 - 9.3.0 Patched in 9.3.1
3. Patched Medium · 6.4 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-10-04 CVE-2026-96607 Improper Neutralization of Input During Web Page Generation Affects <= 9.3.1 Patched in 9.3.2
4. Patched Medium · 4.9 NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter ↗
   2026-09-17 CVE-2026-75961 Improper Neutralization of Special Elements used in an SQL Command Affects <= 9.3.0 Patched in 9.3.1
5. Patched Medium · 4.9 NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter ↗
   2026-08-15 CVE-2026-15602 Improper Neutralization of Special Elements used in an SQL Command Affects <= 9.2.4 Patched in 9.2.5
6. Patched High · 8.1 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter ↗
   2026-07-31 CVE-2026-15450 Improper Limitation of a Pathname to a Restricted Directory Affects <= 9.2.3 Patched in 9.2.4
7. Patched Medium · 5.3 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action ↗
   2026-07-10 CVE-2026-9017 Missing Authorization Affects <= 9.2.2 Patched in 9.2.3
8. Patched High · 7.2 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-10 CVE-2026-57668 Improper Neutralization of Input During Web Page Generation Affects <= 9.2.2 Patched in 9.2.3
9. Patched High · 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter ↗
   2026-07-02 CVE-2026-13040 Improper Neutralization of Input During Web Page Generation Affects <= 9.2.2 Patched in 9.2.3
10. Patched High · 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter ↗
    2026-06-30 CVE-2026-12142 Improper Neutralization of Input During Web Page Generation Affects <= 9.2.2 Patched in 9.2.3
11. Patched Medium · 5.3 NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class ↗
    2026-06-26 CVE-2026-12404 Missing Authorization Affects <= 9.2.2 Patched in 9.2.3
12. Patched High · 7.2 NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-06-26 CVE-2026-10525 Improper Neutralization of Input During Web Page Generation Affects <= 9.2.2 Patched in 9.2.3
13. Patched Medium · 4.9 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter ↗
    2026-05-14 CVE-2026-7046 Improper Neutralization of Special Elements used in an SQL Command Affects <= 9.1.12 Patched in 9.1.13
14. Patched High · 7.2 NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names ↗
    2026-05-02 CVE-2026-5063 Improper Neutralization of Input During Web Page Generation Affects <= 9.1.11 Patched in 9.1.12
15. Patched High · 7.5 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id ↗
    2026-03-14 CVE-2026-1947 Authorization Bypass Through User-Controlled Key Affects <= 9.1.9 Patched in 9.1.10
16. Patched Medium · 4.3 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license ↗
    2026-03-13 CVE-2026-1948 Missing Authorization Affects <= 9.1.9 Patched in 9.1.10
17. Patched Medium · 6.1 NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting ↗
    2026-02-09 CVE-2025-69326 Improper Neutralization of Input During Web Page Generation Affects <= 9.1.7 Patched in 9.1.8
18. Patched High · 7.2 NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-02-04 CVE-2025-69324 Improper Neutralization of Input During Web Page Generation Affects <= 9.1.7 Patched in 9.1.8
19. Patched Medium · 5.3 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure ↗
    2026-01-30 CVE-2025-15510 Missing Authorization Affects <= 9.1.8 Patched in 9.1.9
20. Patched Medium · 4.4 Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-12-19 CVE-2025-14803 Improper Neutralization of Input During Web Page Generation Affects <= 9.1.7 Patched in 9.1.8
21. Patched Medium · 4.9 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection ↗
    2025-10-10 CVE-2025-10185 Improper Neutralization of Special Elements used in an SQL Command Affects <= 9.1.6 Patched in 9.1.7
22. Patched Medium · 4.3 NEX-Forms <= 9.1.3 - Cross-Site Request Forgery ↗
    2025-08-20 CVE-2025-49399 Cross-Site Request Forgery Affects <= 9.1.3 Patched in 9.1.4
23. Patched Medium · 6.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function ↗
    2025-05-07 CVE-2025-4208 Improper Control of Generation of Code Affects <= 8.9.1 Patched in 8.9.2
24. Patched Medium · 6.4 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting ↗
    2025-05-07 CVE-2025-3468 Improper Neutralization of Input During Web Page Generation Affects <= 8.9.1 Patched in 8.9.2
25. Patched Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure ↗
    2025-03-11 CVE-2024-13498 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 8.8.1 Patched in 8.8.2
26. Patched Medium · 4.9 NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection ↗
    2024-12-24 CVE-2024-10862 Improper Neutralization of Special Elements used in an SQL Command Affects <= 8.7.15 Patched in 8.7.16
27. Patched Medium · 4.9 NEX-Forms – Ultimate Form Builder <= 8.7.8 - Authenticated (Administrator+) SQL Injection ↗
    2024-12-02 CVE-2024-53808 Improper Neutralization of Special Elements used in an SQL Command Affects <= 8.7.8 Patched in 8.7.9
28. Patched Medium · 6.1 NEX-Forms – Ultimate Form Builder <= 8.7.3 - Reflected Cross-Site Scripting ↗
    2024-09-30 CVE-2024-47389 Improper Neutralization of Input During Web Page Generation Affects <= 8.7.3 Patched in 8.7.4
29. Patched Medium · 6.4 NEX-Forms – Ultimate Form Builder <= 8.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-07-05 CVE-2024-37512 Improper Neutralization of Input During Web Page Generation Affects <= 8.5.10 Patched in 8.6.1
30. Patched Medium · 6.4 NEX-Forms – Ultimate Form Builder <= 8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2024-02-12 CVE-2024-25593 Improper Neutralization of Input During Web Page Generation Affects <= 8.5.5 Patched in 8.5.6
31. Patched Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() ↗
    2024-01-31 CVE-2024-0907 Missing Authorization Affects <= 8.5.6 Patched in 8.5.7
32. Patched Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() ↗
    2024-01-31 CVE-2024-1129 Missing Authorization Affects <= 8.5.6 Patched in 8.5.7
33. Patched Medium · 5.3 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() ↗
    2024-01-31 CVE-2024-1130 Missing Authorization Affects <= 8.5.6 Patched in 8.5.7
34. Patched Medium · 4.3 NEX-Forms – Ultimate Form Builder <= 8.5.2 - Cross-Site Request Forgery ↗
    2023-12-28 CVE-2023-52120 Cross-Site Request Forgery Affects <= 8.5.2 Patched in 8.5.5
35. Patched Medium · 5.5 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.5 - Authenticated (Admin+) SQL Injection ↗
    2023-12-21 CVE-2023-50838 Improper Neutralization of Special Elements used in an SQL Command Affects <= 8.5.5 Patched in 8.5.6
36. Patched Medium · 4.8 NEX-Forms - Ultimate Form Builder <= 8.4.3 - Authenticated Stored Cross-Site Scripting via Form Name ↗
    2023-06-26 CVE-2023-0439 Improper Neutralization of Input During Web Page Generation Affects <= 8.4.3 Patched in 8.4.4
37. Patched High · 7.2 NEX-Forms <= 8.3.3 - Authenticated (Administrator+) SQL Injection ↗
    2023-04-17 CVE-2023-2114 Improper Neutralization of Special Elements used in an SQL Command Affects <= 8.3.3 Patched in 8.4
38. Patched Medium · 6.4 NEX-Forms - Ultimate Form Builder <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-02-28 CVE-2023-0272 Improper Neutralization of Input During Web Page Generation Affects <= 8.3.2 Patched in 8.3.3
39. Patched High · 7.2 NEX-Forms <= 7.9.6 - Authenticated (Administrator+) SQL Injection ↗
    2022-08-01 CVE-2022-3142 Improper Neutralization of Special Elements used in an SQL Command Affects <= 7.9.6 Patched in 7.9.7
40. Patched High · 8.8 NEX-Forms – Ultimate Form Builder <= 8.4.2 - Cross-Site Request Forgery to Cross-Site Scripting ↗
    2021-11-14 CVE-2021-24705 Cross-Site Request Forgery Affects <= 8.4.2 Patched in 8.4.3
41. Patched Medium · 4.3 NEX-Forms <= 7.8.7 Authorization Bypass ↗
    2021-07-19 CVE-2021-34676 Improper Authorization Affects <= 7.8.7 Patched in 7.8.8
42. Patched Medium · 6.3 NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions ↗
    2020-11-27 CVE-2020-36670 Missing Authorization Affects <= 7.7.1 Patched in 7.8
43. Patched Critical · 9.8 NEX-Forms – Ultimate Form Builder < 4.6.1 - SQL Injection ↗
    2015-07-16 CVE-2015-9452 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.6.1 Patched in 4.6.1
44. Patched Critical · 9.8 NEX-Forms – Ultimate Form Builder – Contact forms and much more < 3.4 - SQL Injection ↗
    2015-04-21 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.4 Patched in 3.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-10-08 6K+ → 5K+ down after 7 days in tier
2. 2026-10-01 5K+ → 6K+ up after 1 days in tier
3. 2026-09-30 6K+ → 5K+ down after 1 days in tier
4. 2026-09-29 5K+ → 6K+ up after 1 days in tier
5. 2026-09-28 6K+ → 5K+ down after 124 days in tier
6. 2026-05-27 7K+ → 6K+ down after 1 days in tier
7. 2026-05-26 6K+ → 7K+ up after 1 days in tier
8. 2026-05-25 7K+ → 6K+ down after 92 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for NEX-Forms – Ultimate Forms Plugin for WordPress into a readme, a review or a deck. It updates itself.

NEX-Forms – Ultimate Forms Plugin for WordPress: 5K+ active installs, 4.1★ (135 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/nex-forms-express-wp-form-builder