CVE-2026-9107: Kali Forms WordPress Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-9107 is a stored cross-site scripting (XSS) vulnerability in the Kali Forms plugin for WordPress. The vulnerability exists in the 'meta[kaliforms_field_components]' parameter, which the plugin fails to adequately sanitize on input or escape on output. An authenticated attacker with contributor role or above can craft a malicious payload and persist it in the database. When any user (including administrators) accesses pages or forms containing the injected payload, the malicious script executes in their browser context. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). With a CVSS 3.1 score of 6.4 (MEDIUM severity), the attack vector is network-based, requires low attack complexity, and necessitates prior authentication—but the scope is changed, affecting other users and the wider site.

Business impact

A successful exploitation could result in unauthorized modification of website content, theft of session tokens or sensitive data viewed by administrators, malware distribution to site visitors, or defacement of high-visibility pages. For organizations relying on Kali Forms for lead capture or client communication, compromised forms could damage trust and expose collected user data. The risk is elevated if the plugin is used on sites with high-value pages or frequent administrative activity.

Affected systems

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress in all versions up to and including 2.4.13 is affected. Websites using this plugin are at risk if they grant contributor-level access to untrusted or compromised user accounts. Sites with multiple content creators, agencies, or decentralized editorial workflows are particularly exposed.

Exploitability

Exploitation requires valid WordPress account credentials with at least contributor-level permissions. An attacker must already have authenticated access to the site's dashboard or REST API. The attack itself is trivial once credentials are obtained—injection requires only crafting a payload in a form field and saving it. No user interaction beyond viewing the affected page is needed to trigger code execution. The barrier to exploitation is primarily account access, not technical complexity.

Remediation

Update the Kali Forms plugin to a patched version released after 2.4.13. Verify the patch version against the official Kali Forms repository or the plugin's advisory. As an interim measure, restrict contributor-level access to only trusted team members, audit existing contributor and editor accounts for suspicious activity, and review form submissions and page content for signs of injected scripts. Consider disabling the plugin on non-critical sites until an update is available.

Patch guidance

Upgrade to the latest version of the Kali Forms plugin available in the official WordPress plugin repository. Check the plugin's changelog or security advisories for the specific version number that addresses CVE-2026-9107; verify this against the vendor's official sources before deploying to production. Test the upgrade on a staging environment first to ensure form functionality and existing form data are not disrupted. After patching, review user roles and permissions to ensure only authorized accounts retain contributor status or above.

Detection guidance

Monitor WordPress user logs for unusual account activity, particularly by contributor-level or editor-level accounts. Use security plugins or manual inspection to search for suspicious JavaScript or HTML in form field component metadata (check the postmeta table for entries with 'kaliforms_field_components' keys containing script tags or event handlers). Review page edit histories and revision logs for unexpected changes to pages using Kali Forms. Set up alerts for modifications to form settings by low-privileged accounts. Consider enabling WordPress security logging or using a Web Application Firewall to flag stored XSS payload patterns in form submissions.

Why prioritize this

Although the CVSS score is MEDIUM (6.4), this vulnerability warrants prompt attention because: (1) stored XSS on WordPress sites can affect high-value pages and compromise administrative workflows; (2) the ease of exploitation for users with contributor access increases insider-threat risk; (3) patching is straightforward and low-risk; (4) delayed patching extends exposure to data theft and site defacement. Prioritize sites where Kali Forms captures sensitive information or is visible to public visitors.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects: network-accessible attack surface (AV:N), low complexity (AC:L), required authentication (PR:L), no user interaction needed (UI:N), and changed scope (S:C) affecting other users. Confidentiality and integrity are partially impacted (C:L, I:L), but availability is not affected (A:N). The score appropriately balances the need for prior authentication against the broad scope and persistence of stored XSS. In practice, organizations with high-assurance requirements for form data integrity or sites with public-facing forms may assess risk higher than the baseline score.

Frequently asked questions