CVE-2025-69326
Published: 20 February 2026
Summary
CVE-2025-69326 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-69326 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the Basix NEX-Forms plugin (nex-forms-express-wp-form-builder) for WordPress. The issue impacts all versions from n/a through 9.1.7 and was published on 2026-02-20. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious input that reflects back to users via the web page, tricking victims into interacting (e.g., clicking a link or submitting a form). Successful exploitation allows execution of arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking, data theft, or further phishing, though impacts are limited per the CVSS metrics.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/nex-forms-express-wp-form-builder/vulnerability/wordpress-nex-forms-plugin-9-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the Reflected XSS flaw in version 9.1.7 and recommends updating to a patched version or applying available mitigations for affected WordPress installations using the NEX-Forms plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207606
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through <= 9.1.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables arbitrary JavaScript execution in the browser (T1059.007) and supports drive-by compromise via malicious links (T1189).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted web inputs to block the malicious payloads that cause reflected XSS in the NEX-Forms plugin.
Requires filtering or encoding of information sent to users, preventing reflected script execution even when input neutralization fails.
Mandates timely remediation of known flaws such as the reflected XSS in NEX-Forms versions <= 9.1.7 by applying vendor patches.