CVE-2026-15395: Kali Forms WordPress Plugin XSS Vulnerability

CVE-2026-15395 Overview

CVE-2026-15395 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress. The flaw affects all versions up to and including 2.4.18. It stems from insufficient input sanitization and output escaping on the digitalSignature field value processed during form submission.

Unauthenticated attackers can inject arbitrary web scripts that execute when any user views a page containing the stored payload. The form-submission nonce required to submit the form is publicly available on any page rendering the form shortcode, removing the authentication precondition typically associated with WordPress form submissions.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browsers of visitors and administrators, enabling session theft, admin account takeover, and further site compromise.

Affected Products

Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress
All versions up to and including 2.4.18
WordPress sites publishing any page or post that renders a Kali Forms shortcode

Discovery Timeline

2026-07-17 - CVE-2026-15395 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-15395

Vulnerability Analysis

CVE-2026-15395 is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. The vulnerable plugin accepts a digitalSignature field value from form submissions and stores it without applying sufficient sanitization. When the stored value is later rendered on a page — such as within a submission display shortcode — the plugin also fails to escape the output.

The attack surface is broad because Kali Forms is a widely deployed contact form builder. Any page hosting the form shortcode exposes the form submission endpoint alongside the required nonce, so no login or user interaction is required to plant the payload. The stored payload persists across page loads and fires in every visiting browser, including authenticated administrators.

Successful exploitation can lead to administrator session hijacking, credential harvesting through injected phishing overlays, redirection to attacker-controlled infrastructure, and lateral movement into the WordPress admin dashboard for full site takeover.

Root Cause

The root cause is missing sanitization on input and missing escaping on output for the digitalSignature field. Relevant code paths reside in Inc/Frontend/class-form-processor.php at lines 88 and 997, and in Inc/Frontend/class-submission-shortcode.php at line 198. The submission handler stores the raw field value and later emits it back into the HTML response without contextual escaping.

Attack Vector

Attack traffic originates over the network with no authentication and no user interaction. An attacker locates any published page containing a Kali Forms shortcode, retrieves the publicly rendered submission nonce, and submits a crafted form payload where the digitalSignature field contains JavaScript. The payload is persisted server-side and executes each time the compromised page is rendered.

No verified exploit code is publicly available. Refer to the Wordfence Vulnerability Report and the WordPress plugin changeset for the sanitization fix applied by the vendor.

Detection Methods for CVE-2026-15395

Indicators of Compromise

Form submission requests to Kali Forms endpoints containing <script>, onerror=, onload=, javascript:, or encoded script fragments inside the digitalSignature parameter.
Unexpected <script> tags or event-handler attributes appearing in stored form submission records or on pages rendering the submission shortcode.
Outbound requests from visitor browsers to unfamiliar domains shortly after loading a page that hosts a Kali Forms shortcode.
New WordPress administrator accounts or altered user roles created after suspicious form submissions.

Detection Strategies

Review the WordPress database tables used by Kali Forms for stored submission fields containing HTML tags or JavaScript syntax.
Inspect web server access logs for POST requests to Kali Forms submission endpoints with anomalous payload sizes or script keywords in digitalSignature.
Deploy web application firewall rules that block script tokens and event handlers in the digitalSignature parameter.
Compare the deployed plugin version against 2.4.18 and confirm whether the vendor patch changeset has been applied.

Monitoring Recommendations

Alert on any WordPress admin session that originates from a page rendering a Kali Forms shortcode and immediately performs privileged actions.
Monitor for unexpected changes to WordPress user roles, options, or plugin/theme files following form submissions.
Enable content security policy reporting to surface inline script execution on pages that should not contain scripts.

How to Mitigate CVE-2026-15395

Immediate Actions Required

Update the Kali Forms plugin to a version later than 2.4.18 that includes the sanitization and escaping fix referenced in the vendor changeset.
Audit existing form submissions for stored payloads containing HTML or JavaScript in the digitalSignature field and remove malicious records.
Rotate credentials for any WordPress administrator who accessed pages rendering Kali Forms output while the site was vulnerable.
Review installed WordPress users and remove any unauthorized administrator accounts.

Patch Information

The vendor addressed the vulnerability in the plugin release following 2.4.18. The fix is documented in the WordPress plugin changeset 3609303, which adds sanitization for the digitalSignature field value in class-form-processor.php and escaping in class-submission-shortcode.php. Additional analysis is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the Kali Forms plugin until the patched version can be deployed if immediate patching is not possible.
Unpublish or password-protect pages containing Kali Forms shortcodes to prevent unauthenticated access to the submission nonce.
Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in the digitalSignature request parameter.
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering Kali Forms submissions.

bash

# Example WAF rule concept (ModSecurity) to block script content in digitalSignature
SecRule ARGS:digitalSignature "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1015395,phase:2,deny,status:403,log,msg:'CVE-2026-15395 Kali Forms digitalSignature XSS attempt'"