Kali Forms < 2.4.3 – Contributor+ Stored XSS | CVE 2025-3201 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.

Proof of Concept

1) Create a new Form with "Dropdown" block
2) In the "Options" section, add the payload `123" onclick=alert(1)//` to the "Choice" field
3) An admin will need to publish the form
4) To trigger XSS, place the shortcode for the form on any Post/Page and click on option dropdown

Affects Plugins

Fixed in 2.4.3

References

CVE

URL

https://research.cleantalk.org/cve-2025-3201/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

4248289f-36d2-41c5-baf6-bb2c630482ef

Timeline

Publicly Published

2025-04-25 (about 8 months ago)

Added

2025-04-25 (about 8 months ago)

Last Updated

2025-04-25 (about 8 months ago)

Other

Published

Title

Published

2024-06-22

Title

SULly < 4.3.1 - Reflected XSS

Published

2023-04-18

Title

f(x) TOC <= 1.1.0 - Contributor+ Stored XSS

Published

2025-08-01

Title

360 Photo Spheres <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-07-23

Title

FunnelCockpit < 1.4.4 - Reflected Cross-Site Scripting via `error` Parameter

Published

2024-07-11

Title

Link Library < 7.7.2 - Reflected Cross-Site Scripting