This vulnerability arises from improper neutralization of user input when generating web pages, leading to reflected XSS. An attacker can embed malicious scripts that are executed within the victim's browser when they view the affected form. Such scripts may perform actions such as stealing session cookies, defacing the site, redirecting users to phishing pages, or executing other client‑side attacks. The impact is primarily on confidentiality and integrity of user sessions, and can undermine user trust in the website.

The flaw exists in the Basix NEX‑Forms plugin for WordPress, affecting all releases up to and including version 9.3.1 of the NEX‑Forms Express WP Form Builder. Users running any of those versions are potentially vulnerable.

The CVSS score of 7.1 reflects a medium‑high severity and indicates that the vulnerability can be exploited remotely by an attacker, although it requires the victim to visit a crafted URL or otherwise trigger the form. EPSS data is not available, so the probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw relies on reflected XSS, the attack is usually limited to the victim’s browser; however, sophisticated attackers could combine it with social engineering or other phishing tactics to increase impact. Organizations with high public visibility or a large number of visitors should treat this as a significant risk until mitigated.