EUVD-2026-40891
GHSA-cxpx-mm97-whjr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain contributor WordPress credentials
-
DeliveryAccess Kali Forms builder interface
-
ExploitSubmit crafted payload in meta[kaliforms_field_components]
-
InstallPayload stored unescaped in database
-
C2Victim loads page with injected form
-
ExecuteMalicious script executes in victim browser
-
ImpactExfiltrate session cookies or escalate to admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress session with at minimum contributor-level privileges (PR:L per CVSS vector). The target site must have the Kali Forms plugin installed and active on version 2.4.13 or earlier. The attacker must have access to the Kali Forms drag-and-drop builder interface to submit the malicious 'meta[kaliforms_field_components]' parameter. Exploitation is limited by the contributor access requirement - sites with tightly controlled user registration or no contributor-tier accounts are significantly less exposed. A victim user must subsequently visit a WordPress page that renders the injected form for the payload to execute; however, since the script is stored server-side, the attacker does not need to perform any further action after injection. |
| Impact | The CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) is partially consistent with stored XSS mechanics but the UI:N metric warrants scrutiny: stored XSS canonically requires a victim to visit the injected page (UI:R), so the official vector may overstate exploitability slightly. That said, the practical risk remains meaningful on multi-author sites where contributor accounts are common. Attack complexity is genuinely low once contributor credentials are obtained. The scope change (S:C) correctly reflects that the script executes in victims' browser security contexts, enabling session theft and admin takeover. No EPSS score was provided in the intelligence data; this gap means quantitative exploitation probability cannot be stated. KEV status is absent (not confirmed as actively exploited). No POC exploit code was identified. Risk prioritization should be elevated for WordPress deployments with open contributor registration or many editorial users, and treated as moderate-priority on sites with tightly controlled contributor access. |
| Exploit ScenarioDerived | An attacker registers or compromises a contributor-level WordPress account on a target site, then opens the Kali Forms builder and submits a crafted form field definition containing a JavaScript payload in the 'meta[kaliforms_field_components]' parameter. The malicious script is stored in the database without sanitization, and when any visitor - including site administrators - loads a page embedding that form, the script executes in their browser, allowing the attacker to steal session cookies, capture credentials, or escalate to full WordPress admin control. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'meta[kaliforms_field_components]' parameter. Any WordPress user who subsequently visits a page containing the injected form will execute the attacker's script in their browser, making session hijacking, credential theft, and admin account takeover realistic outcomes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege bar (contributor) makes this a realistic risk on multi-author WordPress sites.
RemediationAI
Upgrade to Kali Forms version 2.4.14 or later immediately. The WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fkali-forms/tags/2.4.13&new_path=%2Fkali-forms/tags/2.4.14 confirms a code change between 2.4.13 and 2.4.14, indicating this is the vendor-released fix; however, the exact nature of the fix (sanitization added, output escaping corrected, or both) should be verified via that changeset before assuming complete remediation. If an immediate upgrade is not possible, restrict the WordPress contributor role to only fully trusted users and audit existing contributor accounts for unauthorized additions. As a compensating control, a Web Application Firewall (WAF) rule blocking script tags and JavaScript event handlers in the 'meta[kaliforms_field_components]' POST parameter can reduce exposure, but WAF rules should not replace patching as they can be bypassed. Note that disabling the plugin entirely eliminates the attack surface at the cost of losing all Kali Forms functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Kali Forms drag-and-drop form builder plugin for WordPress (CPE: cpe:2.3:a:wpchill:kali_forms_-_contact_form_&_drag-and-drop_builder:*:*:*:*:*:*:*:*). Based on the referenced source files, the flaw spans both the PHP backend (Inc/Backend/Posts/class-forms.php, lines 381 and 391) and the React-based frontend (resources/assets/js/forms/components/Builder/BuilderFormField.jsx, lines 96 and 332). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin fails to sanitize user-supplied data in the 'meta[kaliforms_field_components]' parameter before storing it, and fails to escape it before rendering it in page output. Because the payload is persisted server-side, it executes in every visitor's browser without any further attacker interaction, driving the Scope metric to Changed (S:C) in the CVSS vector.
Know when Kali Forms Contact Form Drag And Drop Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to visit the injected page (UI:R); all other metrics align with the provided vector.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_components]' parameter in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
The Kali Forms plugin for WordPress contains a critical remote code execution vulnerability that allows unauthenticated
Stored cross-site scripting in the Kali Forms WordPress plugin (before 2.4.13) allows Contributor-level users to inject
Kali Forms - Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.17 allows any authenticated Contri
Unauthenticated file upload to the WordPress Media Library is possible in Kali Forms - Contact Form & Drag-and-Drop Buil
Email address disclosure in Kali Forms versions before 2.4.30 allows authenticated Subscriber-level users to retrieve th
Kali Forms versions before 2.4.30 expose its test-email handler to any authenticated user, allowing a Subscriber-level a
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute a
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions
Exploit-DB