The vulnerability is a stored cross‑site scripting flaw that allows an attacker to insert unsanitized input into the NEX‑Forms plugin. This stored data is later rendered on the web page, enabling execution of arbitrary client‑side code by any visitor who loads that page. The exact downstream effects (such as defacement or data theft) are not specified in the CVE data, so only the capabilities of the stored XSS are asserted.

The issue affects the Basix NEX‑Forms WordPress plugin for versions from the earliest release through any version <= 9.2.2. Versions newer than 9.2.2 are not indicated as vulnerable.

The CVSS score of 7.1 indicates a moderate‑to‑high severity for this stored XSS flaw. The EPSS score of less than 1% suggests a low likelihood of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. Based on the stored nature of the flaw, the likely attack path involves malicious input submitted through the plugin’s form interface that is subsequently rendered to visitors. This inference is derived from the description of stored XSS and is not explicitly stated.