CVE-2023-0272

Name of the Vulnerable Software and Affected Versions NEX-Forms WordPress plugin versions prior to 8.3.3

Description The issue concerns the NEX-Forms WordPress plugin, which does not properly validate and escape some of its shortcode attributes before outputting them in a page or post. This could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Recommendations For versions prior to 8.3.3, update to version 8.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of shortcodes by users with the contributor role and above until the update is applied.