CVE-2026-11581
Description
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
How to fix
- Kali Forms — Contact Form & Drag-and-Drop Builder2.4.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Kali Forms — Contact Form & Drag-and-Drop Builder | v < 2.4.13 | 2.4.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.