Kali Forms Plugin Stored XSS Vulnerability

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Kali Forms WordPress plugin before version 2.4.29. Users with author-level access or higher can inject arbitrary JavaScript into a form button configuration. The injected script executes in the browser of any user who interacts with the button, including administrators.

Useful 0 Not Useful 0

Detection Guidance

Check if your Kali Forms plugin version is below 2.4.29. Inspect form buttons for suspicious JavaScript in configurations. Review server logs for unusual form submissions or interactions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with author-level access could inject malicious JavaScript into a form button. When an administrator or other user clicks the button, the script runs in their browser session, potentially stealing session cookies, redirecting to phishing pages, or performing unauthorized actions on their behalf.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if forms handle such data. Both standards require safeguards against unauthorized code execution and data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Kali Forms plugin to version 2.4.29 or later immediately. Remove or restrict author-level and higher user access to form configurations until updated. Monitor for unauthorized form changes or suspicious activity.

Useful 0 Not Useful 0