The NEX‑Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross‑Site Scripting via the '_name[]' array parameter in all versions up to and including 9.2.2 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses an injected page. The wp_kses() output filtering pass provides no mitigation because NEXForms_allowed_tags() explicitly permits <script>, <iframe src/srcdoc>, and JavaScript event handlers such as onClick, onBlur, and onChange in its allow list.

The affected product is the official NEX‑Forms plugin for WordPress by Webaways, versions up to and including 9.2.2. An upgrade to 9.2.3 or later removes the vulnerability.

Based on the description, it is inferred that attackers can persist malicious payloads by submitting them through the '_name[]' field; the payload is then stored and rendered in subsequent page views. The CVSS score of 7.2 classifies this as a high‑severity flaw. Because the attack requires no authentication and the payload can be persisted, successful exploitation has significant impact. The EPSS score is < 1%, indicating a low but non‑zero probability that attackers will attempt the exploitation, and the vulnerability is not listed in the CISA KEV catalog. The documented exploitation path—submitting a malicious value via the '_name[]' parameter and having it rendered in subsequent page views—implies that attackers can easily craft and deploy attacks without privileges, posing a real threat to site visitors.