CVE-2026-16144

The CVE-2026-16144 entry concerns Kali Forms ≤ 2.4.20 (WordPress plugin) with unauthenticated Remote Code Execution via the _save_data function. The root cause is insufficient validation of the _save_data() path when a form field value can overwrite a trusted placeholder, allowing attacker-contro...

CVE-2026-65446

CVE-2026-65446 affects the WordPress Kali Forms plugin up to version 2.4.18, with an unauthenticated Cross Site Scripting (XSS) vulnerability reported. The connected documents specify an XSS flaw in Kali Forms

CVE-2026-11579

CVE-2026-11579 affects the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin up to version 2.4.17. The issue arises because the plugin does not verify that a file upload is tied to an existing form with a file-upload field, allowing unauthenticated users to upload files to the Wo...

CVE-2025-3201 Kali Forms < 2.4.3 - Contributor+ Stored XSS

The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks...

CVE-2020-36712

The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliformsformdeleteuploadedfile function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to dele...