What is the CVSS score of CVE-2026-15395?

CVE-2026-15395 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Kali Forms are affected by CVE-2026-15395?

The Kali Forms WordPress plugin (versions through 2.4.18) contains a stored cross-site scripting vulnerability permitting unauthenticated attackers to persistently inject malicious JavaScript into…

How to fix or mitigate CVE-2026-15395?

Within 24 hours: audit all WordPress installations for Kali Forms through version 2.4.18 using vulnerability scanning tools, immediately disable the plugin across affected sites, and deploy Web Application Firewall rules blocking POST submissions to form endpoints. Within 7 days: for sites requiring continued operation, implement Content Security Policy headers to restrict inline script execution, add WAF rules to sanitize the digitalSignature field on input, and conduct forensic review of form submission logs and administrative audit trails for the past 30 days to identify prior exploitation. Within 30 days: migrate all affected WordPress sites to an alternative form solution (WPForms, Formidable Forms, or Gravity Forms), complete forensic validation that no backdoors or admin accounts were created through the vulnerability, and retire the Kali Forms plugin entirely from infrastructure.

Kali Forms CVE-2026-15395

EUVD-2026-45130 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-17 Wordfence

GHSA-mjg8-2mjg-9rwc

WordPress XSS Kali Forms Contact Form Drag And Drop Builder Wordpress Plugin Wpchill

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network stored XSS with public nonce (PR:N/AC:L); scope changes to the victim browser (S:C) with limited confidentiality/integrity and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 04:21 vuln.today

CVE Published

Jul 17, 2026 - 02:31 cve.org

HIGH 7.2

DescriptionCVE.org

The Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form-submission nonce is publicly available on any page containing the form shortcode, making this exploitable by fully unauthenticated attackers without any precondition beyond the form being published.

AnalysisAI

Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions through 2.4.18) lets fully unauthenticated attackers persist arbitrary JavaScript through the form's 'digitalSignature' field value, which is neither sanitized on input nor escaped on output. Because the form-submission nonce is exposed on any page rendering the form shortcode, the normal anti-CSRF barrier provides no protection, and the injected script executes in the browser of any user (including administrators) who later views the affected page. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a practical scan-and-spray candidate.

Technical ContextAI

The vulnerability lives in the plugin's frontend submission-handling code (Inc/Frontend/class-submission-shortcode.php and Inc/Frontend/class-form-processor.php, referenced around lines 88, 198, and 997 in the 2.4.17/2.4.18 sources). Kali Forms is a drag-and-drop WordPress form builder that renders forms via a shortcode; the 'digitalSignature' field type captures a signature value that is stored with the submission and later reflected into generated pages. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) failure: the field value is trusted end-to-end without WordPress escaping primitives such as esc_html or wp_kses on storage or on output rendering, so markup in the field survives into the DOM. The Scope:Changed CVSS flag reflects that the vulnerable component (the WordPress site/plugin) causes impact in a separate security authority - the victim's browser session and the WordPress admin context.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is present in the WordPress plugin repository changeset 3609303 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3609303%40kali-forms&new=3609303%40kali-forms), but the input data does not state an exact tagged release, so administrators should update Kali Forms to the latest available version above 2.4.18 and verify the version string against the Wordfence advisory rather than assuming a specific number. Until a confirmed patched release is installed, compensating controls include temporarily unpublishing or shortcode-removing any forms that use the digitalSignature field (eliminates the injectable sink but disables signature capture), placing the site behind a WAF such as Wordfence with XSS rules enabled to filter script payloads in submissions (may cause false positives on legitimate signature data), and reviewing stored submissions and rendered submission pages for injected markup before administrators open them (labor-intensive and does not stop the injection itself). Consult the advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/90e39398-19d7-435d-b23f-e93b8cdbcae4?source=cve for the confirmed fixed version.