Kali Forms CVE-2026-15395

The target WordPress site must have a Kali Forms form published via the form shortcode that includes a 'digitalSignature' field, which is the exact injectable sink. No authentication is required (CVSS PR:N) and no attacker-side interaction is needed to plant the payload; the submission nonce that would normally gate the POST is publicly readable from any page rendering the form shortcode, so it is not a real limiting factor. The practical limiting conditions are therefore that the form must be published and reachable, it must use the digitalSignature field type, and the plugin version must be 2.4.18 or earlier; payload execution additionally requires that some user (for example an admin reviewing submissions) subsequently loads the page into which the value is reflected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) describes a remotely reachable, low-complexity, unauthenticated injection requiring no attacker-side user interaction, and the description confirms this is realistic because the required submission nonce is publicly retrievable from the shortcode-bearing page, removing the usual practical hurdle. Confidentiality and integrity impacts are Limited (session/cookie theft, defacement, admin-action forgery in the victim's browser) with no availability impact. No EPSS score, KEV entry, or SSVC decision data was provided, so probabilistic and decision-framework signals are unknown rather than low - absence of an EPSS value must not be read as low likelihood. The report originates from Wordfence, a credible WordPress-security source. One nuance to verify: the vector marks UI:N, yet execution of the stored payload still depends on a victim eventually visiting the injected page; the 'no interaction' scoring reflects that the attacker needs no interaction to plant the payload, which is Wordfence's standard convention for stored XSS. Overall this is a genuine, easily automatable web risk for internet-exposed installations rather than a high-score-but-low-reality finding, though it is not currently confirmed to be under active exploitation.

An attacker crawls WordPress sites for pages containing a Kali Forms shortcode with a digitalSignature field, scrapes the publicly embedded submission nonce from that page, and submits the form with a script payload as the signature value. When a site administrator or visitor later opens the page that renders the stored submission, the injected JavaScript runs in their session, enabling session/cookie theft, forged admin actions, or redirection. No public exploit code is identified at time of analysis, but the low complexity and unauthenticated network vector make weaponization straightforward.