The vulnerability results from improper neutralization of user input during web page generation, allowing attackers to store malicious scripts in the NEX‑Forms plugin. An attacker can inject JavaScript that executes when any visitor loads a page containing the compromised form, leading to credential theft, session hijacking, or defacement. This is a stored XSS flaw identified as CWE‑79, enabling persistent malicious code that renders in every page using the affected form fields.

The affected product is the Basix NEX‑Forms plugin for WordPress. Any site that has the plugin installed at version 9.1.7 or earlier is potentially vulnerable. No specific operating systems are listed, as the flaw lies entirely within the plugin’s code executed on the WordPress site.

The CVSS score of 7.1 classifies the flaw as high severity. The EPSS score of less than 1% indicates that attacks are not commonly observed, yet the ease of exploitation—submitting a form with injected script—means the actual risk could increase if the plugin remains unpatched. The flaw is not listed in the CISA KEV, which suggests there are no confirmed exploit variants in the wild. Attackers would likely target any vulnerable site by creating a malicious form entry, which is then rendered to all visitors; no privileged access is required.