CVE-2026-42703

The Kali Forms plugin for WordPress contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 2.4.27.

The Kali Forms plugin through version 2.4.27 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.

Kali Forms version 2.4.23 and earlier has an Unauthenticated Broken Access Control vulnerability. This means an unauthenticated attacker can access functions that should be protected.

The Kali Forms plugin for WordPress is vulnerable to remote code execution via the `_save_data()` function. Insufficient validation of the `thisPermalink` field allows unauthenticated attackers to pass a controlled string to `call_user_func()`, enabling code execution on the server.

A Cross Site Scripting (XSS) vulnerability in the Kali Forms plugin for WordPress versions up to 2.4.18. An unauthenticated attacker can inject a malicious script.

The Kali Forms plugin version 2.4.18 and earlier allows a user with the Subscriber role to delete arbitrary files on the server. The vulnerability does not require special privileges beyond a standard subscriber account.

The Kali Forms plugin for WordPress (versions up to 2.4.18) is vulnerable to stored XSS via the 'digitalSignature' field. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when users access the affected page.

The Kali Forms WordPress plugin before version 2.4.17 lacks a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by the plugin.

The Kali Forms WordPress plugin before version 2.4.17 does not verify that a file upload is associated with an existing form configured with a file-upload field, allowing unauthenticated users to upload files to the WordPress Media Library. Uploads are limited to default-allowed MIME types, so code execution is not possible.

The Kali Forms plugin for WordPress up to version 2.4.13 is vulnerable to Stored XSS via the 'meta[kaliforms_field_components]' parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the compromised page.