Wordfence’s post left out some important information about this, including that the vulnerability is reported to have been exploited at least as far back as June 9: https://wpscan.com/vulnerability/8843d66b-e895-4336-afda-00b99442cdc1

In reviewing the vulnerability, we found that there is still a vulnerability related to the insecurity that caused the fixed vulnerability in Merge Tags functionality. We contacted the developer about that over the weekend, but we haven’t gotten a response and so far it hasn’t been addressed: https://www.pluginvulnerabilities.com/2022/06/20/ninja-forms-merge-tags-functionality-is-still-vulnerable/

The claimed authenticated stored cross-site scripting (XSS) vulnerability mentioned isn’t really a vulnerability. but to the extent there really was a security issue, we notified the developer about part of that in January and they took until June to address it. There was a real vulnerability fixed in that version: https://www.pluginvulnerabilities.com/2022/05/27/our-proactive-monitoring-caught-a-csrf-php-object-injection-vulnerability-in-1-million-install-wordpress-plugin-ninja-forms/