Vulnerability in Kali Forms — Contact Form & Drag-And-Drop Builder
CVE-2026-11581
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.002 (13.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 13.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Kali Forms — Contact Form & Drag-And-Drop Builder — versions 0
References
- wpscan.com/vulnerability/a9282260-a0f2-4fe2-9acf-3191f4043910/ (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-11581?
- CVE-2026-11581 is a medium-severity vulnerability in Kali Forms — Contact Form & Drag-And-Drop Builder, classified under CWE-79 CROSS-SITE SCRIPTING (XSS). CVSS score: 5.9/10. Published 2026-06-30.
- How severe is CVE-2026-11581?
- Medium severity. CVSS v3 base score is 5.9 out of 10.