WordPress NEX-Forms Plugin Stored XSS via Array Parameters

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses() output filtering pass provides no mitigation because NEXForms_allowed_tags() explicitly permits <script>, <iframe src/srcdoc>, and JS event handlers such as onClick, onBlur, and onChange in its allow-list.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

NEX-Forms, a popular WordPress form builder plugin trusted by thousands of websites, contains a stored cross-site scripting (XSS) vulnerability in its array parameter handling. Attackers can inject malicious JavaScript through the '_name[]' parameter without requiring authentication, meaning any visitor can poison form submissions that persist in the database. When site administrators or other users later view these injected pages, the malicious scripts execute in their browsers with full access to their session context. This vulnerability affects all versions up to 9.2.2 and is particularly dangerous because the plugin's custom wp_kses() filtering mechanism fails to properly sanitize the vulnerable parameter, leaving websites open to credential theft, account takeover, and malware distribution.

Casky's 322 matching skills leverage Claude AI's extended reasoning to correlate this vulnerability across two critical MITRE ATT&CK techniques: TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe detection patterns identifying how attackers probe form parameters for injection points (reconnaissance phase) before escalating to stored payload injection (initial access). The platform's skill mapping helps security teams recognize that insufficient input sanitization in user-controlled array parameters—combined with weak output escaping—creates the exact conditions for persistent XSS exploitation. In their findings, practitioners would see flagged instances of unsanitized $_POST array handling, inadequate wp_kses() configurations, and execution of JavaScript within WordPress administrative contexts, enabling them to prioritize patching and implement compensating controls like Web Application Firewalls before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12142.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

achieving-cmmc-level-2-compliance

compliance governance · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-12142

Casky has 322 skills that investigate the attack patterns behind CVE-2026-12142. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn