CVE-2026-11581— Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption

Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.

N/A

N/A

WP Chill Kali Forms 跨站脚本漏洞

WP Chill Kali Forms是WP Chill团队的一款表单构建插件。 WP Chill Kali Forms 2.4.13之前版本存在跨站脚本漏洞，该漏洞源于未对表单字段标题进行清理和转义，将其作为列标题输出，允许具有贡献者级别或更高级别访问权限的用户存储JavaScript，该脚本在管理员会话中执行；同时，该插件在复制操作后缺少功能检查，允许贡献者发布恶意表单，从而可能导致管理员执行该表单。

N/A

N/A