The NEX‑Forms – Ultimate Forms Plugin for WordPress allows an unauthenticated attacker to store arbitrary JavaScript by placing malicious code in the names of POST parameters. When these pages are subsequently viewed, the unescaped script is executed in the victim’s browser, providing a classic stored XSS vector that can be used for session hijacking, credential theft or malicious redirects. This weakness is classified as CWE‑79 and represents a direct compromise of the user’s browser environment.

The vulnerability affects the NEX‑Forms – Ultimate Forms Plugin for WordPress, specifically versions up to and including 9.1.11. No additional version information is provided in the advisory.

The CVSS score of 7.2 places this flaw in the high‑severity range. Because the EPSS score is not available, the empirical likelihood of exploitation cannot be quantified, but the absence of a KEV listing suggests no widely known active exploits yet. The attack can be carried out without authentication by sending a crafted POST request to the form submission endpoint, making it relatively straightforward to exploit for any visitor with access to an affected form page.