CVE-2026-11581: Kali Forms Stored XSS & Privilege Escalation in WordPress Plugin

Technical summary

The vulnerability stems from two related flaws in Kali Forms before 2.4.13. First, user-supplied input in a form field's caption parameter is not sanitized before being output as a column header on the wp-admin form-entries screen, creating a stored XSS vector accessible to Contributors and above. Second, the post-duplication action lacks capability checks, permitting Contributors to change the post status to 'publish' without the proper permissions required for that action. An attacker with Contributor access can chain these weaknesses: inject XSS payload into a caption, duplicate the form to publish it, and await administrator interaction with the form entries page where the payload executes in the admin's authenticated session.

Business impact

This vulnerability poses a direct threat to administrator accounts and site integrity. Successful exploitation can lead to session hijacking, administrative credential theft, malicious plugin installation, or wholesale site defacement by an attacker with only Contributor-level access. Because the payload executes in the context of an authenticated administrator, attackers can perform any action the admin can, including creating new admin accounts or modifying critical site settings. For multi-author WordPress sites where Contributors are commonly used, this represents a significant privilege-escalation and lateral-movement risk.

Affected systems

WordPress sites running Kali Forms — Contact Form & Drag-and-Drop Builder plugin in versions prior to 2.4.13 are affected. Any site where Contributor-level or higher users exist is at risk. The vulnerability does not affect the plugin versions 2.4.13 and later.

Exploitability

Exploitability is moderately straightforward for an attacker with Contributor credentials. No special tools or sophisticated techniques are required—the attacker uses the standard WordPress admin interface to create or edit a form, inject JavaScript into a field caption, and trigger form duplication to publish it. Administrator interaction is required (viewing the form entries screen), but this is routine administrative work. The CVSS score of 5.9 reflects the medium severity: network-accessible, low complexity, high privilege requirement (Contributor+), but user interaction needed (admin must view the page) and contained scope.

Remediation

Update the Kali Forms plugin to version 2.4.13 or later immediately. This version includes input sanitization for form field captions and adds proper capability checks to the post-duplication action. Sites should audit recent form entries and form modifications by Contributors for suspicious JavaScript or unexpected captions before updating, and consider temporarily revoking or restricting Contributor access if compromise is suspected.

Patch guidance

WordPress administrators should navigate to Plugins → Installed Plugins, locate Kali Forms, and click 'Update Now' if version 2.4.13 or later is available. Verify the update completed successfully and that the plugin version displayed matches 2.4.13 or higher. For sites with automatic updates disabled, manually download the latest version from the WordPress plugin directory and follow the plugin update procedure. Test the plugin functionality on a staging environment if possible before deploying to production. No database migration or configuration changes are required; the patch is backward-compatible.

Detection guidance

Monitor WordPress admin activity logs for unusual form creation or modification by Contributor accounts, especially changes to form field names or captions containing script tags or event handlers (onclick, onload, onerror, etc.). Review the form entries page in wp-admin under the Kali Forms interface and inspect any recently added or modified form captions for embedded HTML or JavaScript. Check post_meta and postmeta tables for form configurations containing unsanitized script payloads. Enable WordPress security logging plugins to track post-duplication actions and permission changes. Search access logs for POST requests to form-related admin pages from unexpected user agents or IP ranges.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. The CVSS score of 5.9 (MEDIUM) and the requirement for Contributor-level access and administrator interaction place it in the standard priority tier. However, sites with open Contributor roles, guest authorship, or multi-author environments should prioritize this update higher because the attack surface is larger. The fact that it is not yet on CISA's KEV catalog suggests real-world exploitation has not been widespread, but stored XSS leading to admin session compromise is a known attack pattern and should be treated seriously.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H—Contributor level), required user interaction (UI:R—admin must view form entries), changed scope (S:C—affects admin resources beyond the plugin), and low impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The 'high privilege' modifier prevents a higher score despite the stored XSS nature; the score correctly weights that only privileged users can inject the payload, though any Contributor can do so.

Frequently asked questions