The vulnerability is an instance of CWE‑79, where user‑supplied input is stored and later displayed to visitors without proper neutralisation. This flaw permits an attacker to inject JavaScript or other malicious payloads into form data, which are then rendered on the affected pages. As a result, an attacker can execute code in any user’s browser that views the page, potentially defacing the site or stealing information through client‑side attacks.

The flaw affects installations of the NEX‑Forms plugin developed by Basix for WordPress. The affected version range is stated as from n/a through <= 9.2.2. It can be inferred that versions newer than 9.2.2 are not impacted, but this inference is not explicitly stated in the input.

The CVSS score of 7.1 indicates a moderate‑to‑high severity for this stored XSS flaw. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description of stored input, the most plausible attack vector involves the plugin’s form editing or submission interface where malicious markup could be embedded, stored, and later rendered to visitors. This attack path is inferred from the stored nature of the flaw and is not directly stated in the advisories.