The NEX-Forms – Ultimate Forms Plugin for WordPress (up to version 9.1.11) contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the submit_nex_form() function fails to properly sanitize and escape POST parameter key names, enabling unauthenticated attackers to inject arbitrary web scripts. This vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with a scope change.

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of users visiting the injected pages, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. No known active exploitation has been reported.

No official patch or remediation level has been published by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the vulnerable plugin version to prevent exploitation. Monitor official channels for updates and apply patches promptly once released.