Plugin icon

Kali Forms — Contact Form & Drag-and-Drop Builder

kali-forms

Vulnerabilities:

20

Last Updated:

September 21, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-08-26
Title
Kali Forms — Contact Form & Drag-and-Drop Builder < 2.4.24 - Missing Authorization
Fixed in
Fixed in 2.4.24
CVSS
5.3 (medium)
Published
2026-07-31
Title
Kali Forms < 2.4.21 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
Fixed in
Fixed in 2.4.21
CVSS
8.1 (high)
Published
2026-07-27
Title
Kali Forms < 2.4.19 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.19
CVSS
7.2 (high)
Published
2026-07-22
Title
Kali Forms — Contact Form & Drag-and-Drop Builder < 2.4.19 - Authenticated (Subscriber+) Arbitrary File Deletion
Fixed in
Fixed in 2.4.19
CVSS
8.1 (high)
Published
2026-07-16
Title
Kali Forms < 2.4.19 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value
Fixed in
Fixed in 2.4.19
CVSS
7.2 (high)
Published
2026-06-30
Title
Kali Forms < 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter
Fixed in
Fixed in 2.4.14
CVSS
5.5 (medium)
Published
2026-06-24
Title
Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR
Fixed in
Fixed in 2.4.17
CVSS
5.5 (medium)
Published
2026-06-24
Title
Kali Forms < 2.4.17 - Unauthenticated Media Upload
Fixed in
Fixed in 2.4.17
CVSS
5.3 (medium)
Published
2026-06-09
Title
Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption
Fixed in
Fixed in 2.4.13
CVSS
5.9 (medium)
Published
2026-03-20
Title
Kali Forms < 2.4.10 - Unauthenticated Remote Code Execution via form_process
Fixed in
Fixed in 2.4.10
CVSS
9.8 (critical)
Published
2026-02-17
Title
Kali Forms < 2.4.9 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure
Fixed in
Fixed in 2.4.9
CVSS
4.3 (medium)
Published
2025-04-25
Title
Kali Forms < 2.4.3 - Contributor+ Stored XSS
Fixed in
Fixed in 2.4.3
CVSS
5.9 (medium)
Published
2024-02-19
Title
Contact Form builder with drag & drop for WordPress – Kali Forms < 2.3.42 - Missing Authorization
Fixed in
Fixed in 2.3.42
CVSS
4.3 (medium)
Published
2024-02-19
Title
Contact Form builder with drag & drop for WordPress – Kali Forms < 2.3.42 - Missing Authorization to Arbitrary Plugin Deactivation
Fixed in
Fixed in 2.3.42
CVSS
7.6 (high)
Published
2024-01-17
Title
Contact Form builder with drag & drop - Kali Forms < 2.3.37 - Insecure Direct Object Reference
Fixed in
Fixed in 2.3.37
CVSS
6.5 (medium)
Published
2023-10-16
Title
Contact Form builder with drag & drop - Kali Forms < 2.3.28 - Missing Authorization via Contact Form
Fixed in
Fixed in 2.3.28
CVSS
5.3 (medium)
Published
2023-10-06
Title
Contact Form builder with drag & drop - Kali Forms < 2.3.29 - Missing Authorization via get_log
Fixed in
Fixed in 2.3.29
CVSS
6.5 (medium)
Published
2020-08-21
Title
Contact Form - Form builder by Kali Forms < 2.1.2 - Unauthenticated Arbitrary Post Deletion
Fixed in
Fixed in 2.1.2
CVSS
7.5 (high)
Published
2020-08-21
Title
Contact Form - Form builder by Kali Forms < 2.1.2 - Multiple CSRF Bypass Issues
Fixed in
Fixed in 2.1.2
CVSS
5.4 (medium)
Published
2020-08-21
Title
Contact Form - Form builder by Kali Forms < 2.1.2 - Authenticated Plugin's Settings Change
Fixed in
Fixed in 2.1.2
CVSS
7.1 (high)