Improper neutralization of input in the NEX‑Forms WordPress plugin leads to Reflected Cross‑Site Scripting, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim’s browser. The vulnerability is classified as CWE‑79 and carries a CVSS score of 7.1, indicating moderate to high potential impact on confidentiality, integrity, and availability of the affected web application.

The NEX‑Forms Express WP Form Builder plugin from Basix is affected, for all releases up to and including 9.1.7. Users running the plugin on WordPress sites with these or earlier versions are at risk.

The CVSS score of 7.1 reflects a significant risk, but the EPSS score of <1% indicates a relatively low probability of exploitation in the wild. The vulnerability does not require authentication and can be triggered by sending a crafted URL or form submission that contains malicious script payloads. Because it is not listed in CISA’s KEV catalog, it has not yet been widely reported as a known exploited vulnerability.