Threats tagged 'ghsa-j9pc-2g9w-gcm3'

The NEX-Forms – Ultimate Forms Plugin for WordPress up to version 9.1.11 is vulnerable to a stored cross-site scripting (XSS) flaw. This vulnerability arises from insufficient input sanitization and output escaping of POST parameter key names in the submit_nex_form() function. An unauthenticated attacker can exploit this to inject arbitrary scripts that execute when users access the affected pages.