CVE-2026-12142 is a stored cross-site scripting vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress. The issue exists in all versions up to and including 9.2.2 due to improper neutralization of input during web page generation. Specifically, the '_name[]' array parameter is not properly sanitized or escaped, enabling injection of arbitrary web scripts. The plugin's use of wp_kses() for output filtering is ineffective because its allow-list explicitly permits <script>, <iframe src/srcdoc>, and JavaScript event handlers such as onClick, onBlur, and onChange, which facilitates exploitation. The vulnerability allows unauthenticated attackers to inject scripts that execute in the context of users visiting the compromised pages.

An unauthenticated attacker can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users visiting affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS v3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Avoid using affected versions in production environments and monitor the vendor's communications for updates.