CVE-2023-0439: 
WordPress vulnerability analysis and mitigation

The NEX-Forms WordPress plugin before version 8.4.4 contains a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-0439. The vulnerability was discovered by Felipe Restrepo Rodriguez and Edison Poveda, and was publicly disclosed on June 26, 2023 (WPScan).

The vulnerability stems from inadequate escaping of form names in the plugin. While by default only SuperAdmins (in multisite) and admins (in single site) can create forms, there is a setting that allows administrators to grant this capability to users with lower privileges. The vulnerability has been assigned a CVSS score of 3.5 (low) (WPScan).

When exploited, this vulnerability allows authenticated users with form creation privileges to inject malicious JavaScript code through the form name field, which gets stored and executed when other users access the plugin's dashboard. This could lead to various attacks including data theft, session hijacking, or other malicious actions performed in the context of the victim's browser (WPScan).

The vulnerability has been patched in version 8.4.4 of the NEX-Forms plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).