EUVD-2026-40261
GHSA-6gcj-mc56-7jf5
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
PR:L reflects Contributor-level sufficiency per description; S:C and UI:R capture admin-session XSS; A:N as no availability impact is described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
AnalysisAI
Stored cross-site scripting in the Kali Forms WordPress plugin (before 2.4.13) allows Contributor-level users to inject arbitrary JavaScript into form field captions, which execute in an administrator's browser session when the admin views the form-entries screen. A compounding missing capability check in the plugin's post-duplication action enables the same low-privilege attacker to publish the malicious form without administrator approval, removing the dependency on an admin independently discovering the unpublished form. A publicly available exploit (via WPScan) exists, and the plugin vendor has released a patch in version 2.4.13. No CISA KEV listing is present, indicating no confirmed mass exploitation at time of analysis.
Technical ContextAI
The vulnerability resides in the Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin (CPE: cpe:2.3:a:unknown:kali_forms_-_contact_form_&_drag-and-drop_builder:*:*:*:*:*:*:*:*), versions prior to 2.4.13. The root cause is a failure to sanitize or escape user-supplied form field caption values before rendering them as column headers in the admin form-entries view - a classic stored XSS pattern. WordPress's Contributor role permits users to create and submit draft content but not normally publish it; the missing capability check on the post-duplication AJAX or REST action bypasses this restriction, allowing Contributors to elevate their content to published status. The stored payload persists server-side and fires client-side when the privileged victim loads the entries screen, achieving scope change (S:C in CVSS terms) by crossing from the plugin context into the authenticated administrator session. CWE was not formally assigned in the source data; the applicable CWEs would be CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) and CWE-862 (Missing Authorization).
RemediationAI
The primary fix is to update the Kali Forms plugin to version 2.4.13 or later, which addresses both the missing output sanitization on field captions and the missing capability check on the post-duplication action. Site administrators should apply this update immediately via the WordPress plugin dashboard. If immediate patching is not possible, a compensating control is to audit and revoke Contributor-level accounts for any untrusted users, since exploitation requires at minimum Contributor access - removing untrusted Contributors eliminates the attack surface without disabling the plugin entirely. Additionally, administrators can temporarily disable the Kali Forms plugin until patching is feasible, at the cost of losing active contact forms. Network-layer WAF rules targeting stored XSS payloads in form submissions may partially mitigate but should not be treated as a substitute for patching, as WAF bypass is feasible. Reference: WPScan advisory https://wpscan.com/vulnerability/a9282260-a0f2-4fe2-9acf-3191f4043910/ and VulDB entry https://vuldb.com/vuln/374789.
The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contri
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Buil
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute a
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions
Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticate
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today