Description
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | NEX-Forms | < 9.1.8 | 9.1.8 |
References
- https://wpscan.com/vulnerability/219af0e7-3d8b-4405-8005-b8969a370b0b/ exploit vdb-entry technical-description