An unauthenticated Stored Cross-Site Scripting vulnerability in the NEX-Forms plugin for WordPress allows attackers to inject malicious web scripts into pages accessed by users.

This is a Cross-Site Scripting flaw, classified as CWE-79, occurring via POST parameter key names in the submit_nex_form() function due to insufficient input sanitization and output escaping, requiring no authentication.

A successful exploitation of this vulnerability can lead to unauthorized script execution in the context of a victim browser session, potentially resulting in session hijacking, credential theft, or unauthorized actions performed on behalf of administrative users. The CVSS score of 7.2 reflects a high severity risk primarily driven by network accessibility and the potential for widespread client-side compromise.

Immediate Action: Update the NEX-Forms plugin to the latest patched version once available, or temporarily deactivate the plugin if no fix has been released by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests directed at the submit_nex_form() endpoint, and audit administrative accounts for unexpected modifications.

Compensating Controls: Deploy a Web Application Firewall configured with rules to detect and block malicious script payloads injected within HTTP POST parameters.

Public Exploit Available: No

Given the high CVSS score and the unauthenticated nature of the attack vector, security teams must treat this vulnerability with urgency. Administrators should prioritize applying vendor patches as soon as they are published, or restrict access to the affected endpoint using perimeter defenses until remediation is complete.