Technical impact
Basix NEX-Forms plugin contains an improper neutralization of input during web page generation that permits reflected cross-site scripting. An attacker controlling input can inject arbitrary script into a victim’s browser, potentially stealing cookies, taking over sessions, or executing further attacks. The flaw is not a denial-of-service or privilege escalation but can compromise confidentiality and integrity of user data in a web context.
Affected Systems
WordPress sites using the NEX-Forms plugin, specifically any installation running version 9.3.3 or earlier. The vendor is Basix, product NEX-Forms. No specific WordPress core versions are indicated, so the risk applies broadly to any site with the vulnerable plugin installed.
Risk and Exploitability
The CVSS score of 7.1 categorises this as a medium‑high risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Based on the description, the likely attack vector is a remote attacker manipulating a URL or form submission that is reflected without proper sanitisation. Exploitation requires the user to visit a crafted link or submit malicious input, making the vulnerability dependent on user interaction.
