Stored Cross-Site Scripting in NEX-Forms Plugin by WordPress

CVE-2025-3468

What is CVE-2025-3468?

The NEX-Forms – Ultimate Form Builder plugin for WordPress is subject to a vulnerability that allows for stored cross-site scripting through inadequate input sanitization and output escaping in the clean_html and form_fields parameters. This security flaw enables authenticated users with Custom-level access to inject malicious web scripts into pages. The injected scripts execute whenever a user accesses the affected pages, posing significant risks to site users and potentially leading to broader security compromises.

References