{"id":"CVE-2025-14803","aliases":["EUVD-2026-1733","GHSA-cp58-32qm-mgjw"],"status":"published","title":"Nex-Forms Express WP Form Builder \u003c 9.1.8 - Authenticated Stored XSS","description":"The NEX-Forms  WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms  WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00287,"percentile":0.21473,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-01-09T06:00:13Z","modified":"2026-06-17T08:36:34Z","products":[{"vendor":"basix","product":"nex-forms"},{"vendor":"unknown","product":"nex-forms"}],"references":[{"url":"https://wpscan.com/vulnerability/219af0e7-3d8b-4405-8005-b8969a370b0b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14803"},{"url":"https://wpscan.com/vulnerability/219af0e7-3d8b-4405-8005-b8969a370b0b"},{"url":"https://github.com/advisories/GHSA-cp58-32qm-mgjw"}],"sources":{"cve":[{"id":"CVE-2025-14803","title":"Nex-Forms Express WP Form Builder \u003c 9.1.8 - Authenticated Stored XSS","description":"The NEX-Forms  WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms  WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.","status":"published","published":"2026-01-09T06:00:13.484Z","modified":"2026-01-09T15:16:05.818Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2026-1733","description":"The NEX-Forms  WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms  WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.","status":"published","published":"2026-01-09T06:00:13Z","modified":"2026-01-09T15:16:05Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:54.107539Z"}],"ghsa":[{"id":"GHSA-cp58-32qm-mgjw","title":"The NEX-Forms  WordPress plugin before 9.1.8 does not sanitise and escape some of its settings....","description":"The NEX-Forms  WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms  WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.","status":"published","published":"2026-01-09T06:31:06Z","modified":"2026-01-09T18:31:34Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:05:33.510969Z"}],"nvd":[{"id":"CVE-2025-14803","description":"The NEX-Forms  WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms  WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.","status":"published","published":"2026-01-09T06:16:01.077Z","modified":"2026-06-17T08:36:34.56Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:56.616231Z"}]}}