NEX-Forms CVE-2026-96607

Exploitation requires an attacker to deliver a crafted link containing an XSS payload to a victim who must then open it in a browser with the vulnerable NEX-Forms plugin active (user interaction is required per UI:R, which is the primary limiting factor). As reflected XSS, the payload is not stored and executes only for users who follow the attacker's specific link, so there is no persistent compromise and no mass/automatic exploitation. The flaw is reachable without attacker authentication (PR:N) against sites running NEX-Forms versions up to and including 9.3.1; impact is heightened when the lured victim is a privileged/authenticated WordPress user. The specific vulnerable parameter or endpoint is not detailed in the provided data.

This is a reflected cross-site scripting (CWE-79) flaw in the Basix NEX-Forms WordPress plugin (through 9.3.1), reported by Patchstack. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) scores 7.1 (High) - network-reachable, low-complexity, requiring no attacker privileges but DOES require user interaction (UI:R), which is consistent with reflected XSS that needs a victim to follow a crafted link. The changed scope (S:C) reflects script executing in the victim's browser context beyond the vulnerable component, with Low confidentiality/integrity/availability impact. No EPSS score, no CISA KEV listing, and no public POC were supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent (no conflict between vector and description), but the CVSS is largely theoretical rather than evidence-backed: there is no exploitation-probability (EPSS) data and no active-exploitation signal. Net assessment - this is a credible but moderate-priority web vulnerability typical of the large volume of WordPress plugin XSS issues; it warrants patching in the normal cycle rather than emergency response, with priority rising for sites exposing the plugin to untrusted/unauthenticated visitors. Note: reflected XSS requires social-engineering the victim, so real-world risk is lower than the network-unauthenticated framing alone suggests.

An attacker crafts a malicious URL targeting a vulnerable NEX-Forms endpoint with a reflected, unsanitized parameter and delivers it to a victim (e.g., a logged-in site administrator) via phishing or a planted link. When the victim opens the link, attacker-controlled JavaScript executes in their browser in the context of the WordPress site, potentially enabling session/cookie theft or actions on the victim's behalf. No public proof-of-concept exploit was identified at time of analysis, and successful exploitation depends on the victim interacting with the crafted link (UI:R).