The NEX-Forms – Ultimate Forms Plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the clean_html and form_fields parameters are not properly sanitized or escaped, allowing authenticated attackers with Custom-level privileges to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to 8.9.1. No patch or remediation has been confirmed yet.

Successful exploitation allows an authenticated attacker with Custom-level access to inject persistent malicious scripts into pages generated by the plugin. This can lead to the execution of arbitrary scripts in the browsers of users who view the compromised pages, potentially resulting in information disclosure or session hijacking. The vulnerability does not impact availability and requires authentication, limiting the attack surface. The CVSS score of 6.4 reflects a medium impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Custom-level user permissions to trusted users only and monitor for suspicious activity related to form inputs. Avoid exposing the affected parameters to untrusted users. Follow the vendor's updates closely for an official patch or mitigation instructions.