{"id":"CVE-2026-11581","aliases":["EUVD-2026-40261","GHSA-6gcj-mc56-7jf5"],"status":"published","title":"Kali Forms \u003c 2.4.13 - Contributor+ Stored XSS via Form Field Caption","description":"The Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0024,"percentile":0.15297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-06-30T06:00:01Z","modified":"2026-06-30T15:31:47Z","products":[{"vendor":"unknown","product":"kali forms — contact form \u0026 drag-and-drop builder"},{"vendor":"wpchill","product":"kali forms — contact form \u0026 drag-and-drop builder"}],"references":[{"url":"https://wpscan.com/vulnerability/a9282260-a0f2-4fe2-9acf-3191f4043910/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11581"},{"url":"https://wpscan.com/vulnerability/a9282260-a0f2-4fe2-9acf-3191f4043910"},{"url":"https://github.com/advisories/GHSA-6gcj-mc56-7jf5"}],"sources":{"cve":[{"id":"CVE-2026-11581","title":"Kali Forms \u003c 2.4.13 - Contributor+ Stored XSS via Form Field Caption","description":"The Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.","status":"published","published":"2026-06-30T06:00:01.44Z","modified":"2026-06-30T12:58:54.616Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:20:04.463704Z"}],"euvd":[{"id":"EUVD-2026-40261","description":"The Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.","status":"published","published":"2026-06-30T06:00:01Z","modified":"2026-06-30T12:58:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:21.627235Z"}],"ghsa":[{"id":"GHSA-6gcj-mc56-7jf5","title":"The Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13 does not...","description":"The Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.","status":"published","published":"2026-06-30T09:31:35Z","modified":"2026-06-30T15:31:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:09:05.934873Z"}],"nvd":[{"id":"CVE-2026-11581","description":"The Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form \u0026 Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.","status":"published","published":"2026-06-30T07:16:31.527Z","modified":"2026-06-30T14:14:35.52Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:26.508751Z"}]}}