CVE-2026-81276

CVE-2026-81276 affects the Kali Forms WordPress plugin in versions 2.4.23 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 5.3 (Medium) with an attack vector of network, low complexity, no required privileges, and a low impact on integrity. The issue wa...

WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Kali Forms versions = 2.4.23...

CVE-2026-3584

CVE-2026-3584 – WordPress Kali Forms = 2.4.9 - Esecuzione Remota di Codice Non Autenticato via formprocess 🔥 Riepilogo della Vulnerabilità Il plugin WordPress Kali Forms versioni = 2.4.9 presenta una vulnerabilità critica di esecuzione remota di codice non autenticato RCE. Questa falla...

WordPress Kali Forms <= 2.4.9 - Remote Code Execution

Kali Forms WordPress plugin = 2.4.9 contains a remote code execution caused by unsafe user input handling in 'formprocess' and 'preparepostdata' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication. id: CVE-2026-3584 info: name: WordPress Kal...

WordPress Kali Forms — Contact Form & Drag-and-Drop Builder plugin <= 2.4.20 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin Kali Forms versions = 2.4.20...

CVE-2026-16144

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

CVE-2026-16144

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

EUVD-2026-51755

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

CVE-2026-16144

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is affected by a Remote Code Execution vulnerability up to version 2.4.20. The flaw resides in the _save_data function where insufficient validation of the thisPermalink field allows attacker-controlled strings to overwrit...

CVE-2026-16144 Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

EUVD-2026-49657

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

CVE-2026-65446

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

CVE-2026-65446

CVE-2026-65446 affects the WordPress Kali Forms plugin up to version 2.4.18, with an unauthenticated Cross Site Scripting (XSS) vulnerability reported. The connected documents specify an XSS flaw in Kali Forms

CVE-2026-65446

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

PT-2026-65324

Name of the Vulnerable Software and Affected Versions Kali Forms versions 2.4.18 and earlier Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update Kali Forms to a...

EUVD-2026-48195

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

CVE-2026-59542

The vulnerability CVE-2026-59542 affects the WordPress Kali Forms plugin

PT-2026-63853

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

CVE-2026-15395

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15395

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for...