Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-11581 Stored Cross-Site Scripting in Kali Forms WordPress Plugin Before 2.4.13 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11581
Post summary
The post announces the discovery of a stored XSS vulnerability in the Kali Forms WordPress Plugin (CVE-2026-11581) and provides a link to external details, but no proof of exploitation or mitigation information is supplied.