Improper neutralization of user‑controlled input in Basix NEX‑Forms LITE results in a reflected cross‑site scripting (XSS) flaw. The vulnerability allows an attacker to inject malicious JavaScript into a page that is rendered for another user. Depending on the context, this could enable theft of session cookies, defacement, or redirection to phishing sites.

WordPress sites that have installed the NEX‑Forms LITE plugin in any version older than 8.2 are affected. The plugin is maintained by Basix and can be found under the NEX‑Forms LITE product tag. No specific minor releases are listed beyond the <8.2 threshold.

The CVSS v3.1 baselined score of 7.1 indicates moderate severity, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by directing a visitor to a crafted URL or form submission that includes malicious input, and the reflected script executes in the victim’s browser, potentially allowing data exfiltration or further phishing. Since the flaw is an input‑validation issue, it can be exploited from any network without privileged access, but it requires a victim to view an affected page.