medium6.8
CVE-2025-14803
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings.
Impact
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.
Affected products
| Product | Affected versions |
|---|---|
| NEX-Forms WordPress Plugin | before 9.1.8 |
| Its Settings. The NEX-Forms WordPress Plugin | before 9.1.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.