The vulnerability resides in the NEX‑Forms plugin for WordPress, due to inadequate sanitization of the clean_html and form_fields parameters. It permits an authenticated user with Custom privileges to inject malicious scripts that are stored and subsequently executed whenever the affected form page is viewed. This can lead to compromised client session data, cookie theft, defacement, or other client‑side attacks against any visitor who loads the injected page.

This weakness affects all installations of the NEX‑Forms – Ultimate Forms Plugin for WordPress with version 8.9.1 or earlier. The plugin is distributed under the webaways brand and identified in the vendor list as webaways:NEX‑Forms. No later versions are known to be affected.

With a CVSS score of 6.4 the severity is moderate. The EPSS value is below 1 %, indicating a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need authenticated Custom‑level access to create or edit a form; from that position they can submit malicious payloads that fulfill the stored XSS condition. Once a victim prompts a page containing the injected code, the script runs in that victim’s browser.