Kali Forms — Contact Form & Drag-and-Drop Builder

Vulnerabilities

• CVE-2026-3584

  Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process

  Critical 9.8

• CVE-2026-16144

  Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter

  High 8.1

• CVE-2024-22305

  WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)

  High 8.1

• CVE-2026-59542

  WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability

  High 7.7

• CVE-2026-15395

  Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value

  High 7.2

• CVE-2026-65446

  WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2020-36720→ 2.1.2

  Kali Forms <= 2.1.1 - Missing Authorization to Settings Update

  High 7.1

• CVE-2023-45275

  WordPress Contact Form builder with drag & drop plugin <= 2.3.28 - Broken Access Control vulnerability

  Medium 6.5

• CVE-2026-9107

  Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter

  Medium 6.4

• CVE-2024-1218

  Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization

  Medium 5.4

• CVE-2026-81276

  WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2023-46083

  WordPress Kali Forms plugin <= 2.3.27 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-1860

  Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure

  Medium 4.3

• CVE-2024-1217

  Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation

  Medium 4.3