CVE-2014-7151

Name of the Vulnerable Software and Affected Versions NEX-Forms Lite plugin version 2.1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the form fields parameter in a (1) do edit or (2) do insert action to the "/wp-admin/admin-ajax.php" API endpoint.

Recommendations For NEX-Forms Lite plugin version 2.1.0, consider disabling the form fields parameter in the affected API endpoint until a patch is available. Restrict access to the /wp-admin/admin-ajax.php endpoint to minimize the risk of exploitation. Avoid using the form fields parameter in do edit or do insert actions until the issue is resolved.