Reflected XSS Vulnerability in NEX-Forms by Basix
CVE-2025-69326

7.1HIGH

Key Information:

Vendor

WordPress
Status
Nex-forms
Vendor
CVE Published:
20 February 2026

What is CVE-2025-69326?

The NEX-Forms plugin for WordPress by Basix is susceptible to a reflected cross-site scripting (XSS) vulnerability. This flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects all NEX-Forms versions up to 9.1.7, posing significant risks for websites leveraging this plugin, as it may lead to unauthorized actions or data exposure for users.

Affected Version(s)

NEX-Forms 0 <= 9.1.7

References

https://patchstack.com/database/Wordpress/Plugin/nex-form...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Skalucy | Patchstack Bug Bounty Program
.