What is the CVSS score of CVE-2026-9107?

CVE-2026-9107 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Kali Forms CVE-2026-9107

EUVD-2026-40891 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 Wordfence

GHSA-cxpx-mm97-whjr

WordPress XSS Kali Forms Contact Form Drag And Drop Builder Wordpress Plugin Wpchill

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a victim to visit the injected page (UI:R); all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:20 vuln.today

CVE Published

Jul 01, 2026 - 03:43 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_components]' parameter in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'meta[kaliforms_field_components]' parameter. Any WordPress user who subsequently visits a page containing the injected form will execute the attacker's script in their browser, making session hijacking, credential theft, and admin account takeover realistic outcomes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege bar (contributor) makes this a realistic risk on multi-author WordPress sites.

Technical ContextAI

The vulnerability resides in the Kali Forms drag-and-drop form builder plugin for WordPress (CPE: cpe:2.3:a:wpchill:kali_forms_-_contact_form_&_drag-and-drop_builder:*:*:*:*:*:*:*:*). Based on the referenced source files, the flaw spans both the PHP backend (Inc/Backend/Posts/class-forms.php, lines 381 and 391) and the React-based frontend (resources/assets/js/forms/components/Builder/BuilderFormField.jsx, lines 96 and 332). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin fails to sanitize user-supplied data in the 'meta[kaliforms_field_components]' parameter before storing it, and fails to escape it before rendering it in page output. Because the payload is persisted server-side, it executes in every visitor's browser without any further attacker interaction, driving the Scope metric to Changed (S:C) in the CVSS vector.

RemediationAI

Upgrade to Kali Forms version 2.4.14 or later immediately. The WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fkali-forms/tags/2.4.13&new_path=%2Fkali-forms/tags/2.4.14 confirms a code change between 2.4.13 and 2.4.14, indicating this is the vendor-released fix; however, the exact nature of the fix (sanitization added, output escaping corrected, or both) should be verified via that changeset before assuming complete remediation. If an immediate upgrade is not possible, restrict the WordPress contributor role to only fully trusted users and audit existing contributor accounts for unauthorized additions. As a compensating control, a Web Application Firewall (WAF) rule blocking script tags and JavaScript event handlers in the 'meta[kaliforms_field_components]' POST parameter can reduce exposure, but WAF rules should not replace patching as they can be bypassed. Note that disabling the plugin entirely eliminates the attack surface at the cost of losing all Kali Forms functionality.