Kali Forms - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/kali-forms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 17 Jul 2026 04:18:39 +0000Kali Forms WordPress Plugin Vulnerable to Stored Cross-Site Scripting via digitalSignature Fieldhttps://feed.craftedsignal.io/briefs/2026-07-kali-forms-xss/Fri, 17 Jul 2026 04:18:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-kali-forms-xss/The Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'digitalSignature' field in versions up to and including 2.4.18, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an affected page.The Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress, a widely used tool for creating customizable contact forms, is susceptible to a critical Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-15395. This flaw affects all plugin versions up to and including 2.4.18. The vulnerability stems from insufficient input sanitization and output escaping, specifically impacting the 'digitalSignature' field. This design oversight enables unauthenticated attackers to embed arbitrary web scripts into form submissions. Crucially, the form-submission nonce, a security token typically required for form validity, is publicly available on any page hosting a Kali Forms shortcode. This accessibility streamlines exploitation for attackers, allowing them to bypass authentication requirements and inject malicious scripts that execute whenever a legitimate user, such as a site administrator, views the compromised pages or submitted form entries. The broad usage of the plugin makes this a significant concern for WordPress site owners.

Attack Chain

  1. An unauthenticated attacker identifies a WordPress website utilizing the Kali Forms plugin.
  2. The attacker browses the website to locate a publicly accessible page that displays a Kali Forms shortcode.
  3. The attacker extracts the necessary form-submission nonce, which is publicly available in the page's source code or network traffic, without requiring authentication.
  4. The attacker crafts a malicious HTTP POST request targeting the Kali Forms submission endpoint, embedding the extracted nonce.
  5. Within this crafted POST request, the attacker injects arbitrary web scripts (e.g., <script>alert('XSS')</script>) into the vulnerable 'digitalSignature' field.
  6. The malicious form data, including the embedded script, is submitted and stored by the Kali Forms plugin.
  7. A legitimate user, such as a website administrator, later accesses the backend or a frontend page where this stored form submission data is rendered.
  8. The injected web script executes within the victim's browser, potentially leading to session hijacking, defacement of the website, credential theft, or redirection to malicious sites.

Impact

Successful exploitation of CVE-2026-15395 can lead to significant compromise of the affected WordPress website and its users. Attackers can execute arbitrary JavaScript in the context of the victim's browser, which can include session hijacking, allowing them to take over administrator accounts, defacing website content, redirecting users to malicious sites, or stealing sensitive user data like login credentials or personal information. Due to the unauthenticated nature of the vulnerability and the public availability of the nonce, a wide range of WordPress sites using the Kali Forms plugin are at risk if not updated. The CVSS v3.1 Base Score of 7.2 reflects the high severity and potential for widespread damage.

Recommendation

  • Update the Kali Forms - Contact Form & Drag-and-Drop Builder plugin to version 2.4.19 or higher immediately to patch CVE-2026-15395.
  • Deploy the Sigma rule "Detect Possible Kali Forms XSS Exploitation Attempts" to your SIEM to identify attempts at injecting malicious scripts through web requests.
  • Review webserver access logs and internal application logs for patterns indicating XSS injection attempts in form submission data, especially for parameters related to the digitalSignature field.
]]>highadvisorywordpresspluginxssweb-vulnerabilitystored-xss