Stored XSS in Kali Forms WordPress plugin (CVE-2026-15395)

CVE-2026-15395 is a Stored Cross-Site Scripting vulnerability in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress, arising from insufficient input sanitization and output escaping of the 'digitalSignature' field value. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when any user accesses the affected page; exploitation requires no authentication because the form-submission nonce is publicly available on any page containing the form shortcode. Affected versions: - <= 2.4.18 We recommend updating to: 2.4.19. CVSS 7.2 · our assessment: this_week Vendor advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/90e39398-19d7-435d-b23f-e93b8cdbcae4?source=cve Details: https://vuln.today/cve/CVE-2026-15395