CVE-2024-22305

CVE-2024-22305 affects the Kali Forms WordPress plugin (Contact Form builder with drag & drop) up to version 2.3.36. The vulnerability is Insecure Direct Object References (IDOR) caused by user-controlled access to form object data, allowing unauthorized access to potentially sensitive resources....

CVE-2020-36717

The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to incorrect nonce handling in its functions, affecting versions up to and including 2.1.1. This allows unauthenticated attackers to access the plugin’s administrative functions via forged requests if they ...

CVE-2020-36712

Summary (concrete details from connected docs): CVE-2020-36712 affects the Kali Forms plugin for WordPress (versions up to 2.1.1). The root cause is the kaliforms_form_delete_uploaded_file function, which lacks any privilege or user protections, enabling unauthenticated attackers to delete any si...

CVE-2020-36720

The CVE concerns the Kali Forms plugin for WordPress, affected up to version 2.1.1. Root cause: the update_option function lacks proper authentication checks, allowing any authenticated attacker to change or delete plugin settings. Impact is authenticated options changes, which can affect configu...

CVE-2025-3201

CVE-2025-3201 concerns the WordPress plugin for the Contact Form builder with drag & drop (Kali Forms) prior to version 2.4.3. The vulnerability stems from insufficient sanitization and escaping of certain settings, enabling Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., ...