PT-2026-53813 · WordPress · Kali Forms

She11F · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-11581

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions prior to 2.4.13

Description Stored Cross-Site Scripting occurs because the plugin fails to sanitize a form field's caption before it is displayed as a column header on the administrator form-entries screen. This allows users with Contributor-level access or higher to store JavaScript that executes within an administrator's session. Additionally, a missing capability check in the post-duplication action allows a Contributor to publish the malicious form, ensuring an administrator renders the script.

Recommendations Update Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin to version 2.4.13 or later.

Exploit

Fix

Related Identifiers

CVE-2026-11581

Affected Products

Kali Forms

References · 3

• 🔥 https://wpscan.com/vulnerability/a9282260-a0f2-4fe2-9acf-3191f4043910 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11581 · Security Note
• https://twitter.com/VulmonFeeds/status/2071884251264422236 · Twitter Post