Hann1Bl3L3Ct3R

**Name of the Vulnerable Software and Affected Versions** NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.3 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the ` name[]` array parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user. The `wp kses()` output filtering is ineffective because the `NEXForms allowed tags()` function explicitly permits `<script>`, `<iframe src/srcdoc>`, and JavaScript event handlers such as `onClick`, `onBlur`, and `onChange` in its allow-list. **Recommendations** Update NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.2.3 or later.