Stored XSS in Kali Forms WordPress Plugin

Executive Summary

CVE-2026-11581 is a stored cross-site scripting (XSS) vulnerability in the Kali Forms WordPress plugin versions before 2.4.13.

The vulnerability occurs because the plugin does not sanitize the caption of a form field before displaying it as a column header on the administrator's form-entries screen.

Users with Contributor-level access or higher can inject malicious JavaScript code into these captions.

Additionally, a missing capability check allows Contributors to publish the malicious form by duplicating it, causing the malicious script to execute when an administrator views the form entries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with Contributor-level access to execute arbitrary JavaScript code in the context of an administrator's session.

Such execution can lead to session hijacking, unauthorized actions performed by the administrator, or other malicious activities within the WordPress admin interface.

Because the attacker can publish the malicious form, the attack can be triggered without the administrator's knowledge, increasing the risk of compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Kali Forms WordPress plugin version is prior to 2.4.13, as those versions are affected.

To detect exploitation attempts, you can look for JavaScript payloads injected into form field captions, especially in forms created or duplicated by users with Contributor-level access.

Since the malicious JavaScript executes when an administrator views the form entries screen, monitoring administrator access logs for suspicious activity or unexpected script execution may help.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Kali Forms WordPress plugin to version 2.4.13 or later, where the vulnerability has been fixed.

Additionally, restrict Contributor-level users from creating or publishing forms until the update is applied to prevent exploitation.

Administrators should be cautious when viewing form entries from untrusted contributors to avoid executing malicious JavaScript.

Useful 0 Not Useful 0