Stored Cross-Site Scripting in NEX-Forms Plugin by WordPress

CVE-2025-3468

What is CVE-2025-3468?

The NEX-Forms – Ultimate Form Builder plugin for WordPress is subject to a vulnerability that allows for stored cross-site scripting through inadequate input sanitization and output escaping in the clean_html and form_fields parameters. This security flaw enables authenticated users with Custom-level access to inject malicious web scripts into pages. The injected scripts execute whenever a user accesses the affected pages, posing significant risks to site users and potentially leading to broader security compromises.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References