CVE-2026-11581

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin is affected by CVE-2026-11581 (before 2.4.13). The root cause is a lack of sanitization of a form field caption when it is output as a column header on the admin form-entries screen, enabling stored JavaScript execution in an ...