The NEX-Forms WordPress plugin prior to version 9.2.3 suffers from a stored Cross-Site Scripting (CWE-79) vulnerability. The plugin fails to sanitize and escape certain submitted form data before storing it and rendering it back in the administrative interface. This allows unauthenticated attackers to inject malicious scripts into form submissions, which are then executed in the browsers of administrators or other high privilege users when viewing the entries. No CVSS score or official remediation guidance is currently provided, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to perform stored XSS attacks against high privilege users, potentially leading to session hijacking, privilege escalation, or other malicious actions within the admin dashboard context. This compromises the integrity and security of the administrative interface and could lead to further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the admin dashboard to trusted users only and consider applying web application firewall rules to detect and block malicious input patterns targeting form submissions. Monitor vendor channels for updates regarding patches or official mitigations.