CVE-2026-9107 Overview
CVE-2026-9107 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress. The flaw exists in all versions up to and including 2.4.13. The vulnerability stems from insufficient input sanitization and output escaping on the meta[kaliforms_field_components] parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts execute in the browser of any user who visits an affected page. The issue is tracked under [CWE-79] and was resolved in version 2.4.14.
Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, admin account takeover, and further privilege escalation on the WordPress site.
Affected Products
- Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress
- All versions up to and including 2.4.13
- Fixed in version 2.4.14
Discovery Timeline
- 2026-07-01 - CVE-2026-9107 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-9107
Vulnerability Analysis
The Kali Forms plugin allows users to build contact forms through a drag-and-drop interface backed by React components. Field configuration data is submitted through the meta[kaliforms_field_components] parameter and stored in WordPress post meta. When the form is later rendered, the stored values are output without adequate escaping. This allows an attacker to persist malicious JavaScript inside form field metadata. The payload executes in the context of the site whenever a user renders a page containing the affected form.
Contributor-level access is the minimum privilege required for exploitation. WordPress sites that permit user registration or accept guest authors are particularly exposed. Because the payload is stored server-side, a single injection can affect many visitors over time.
Root Cause
The root cause is missing sanitization on input and missing escaping on output in the form builder code path. Server-side handling in Inc/Backend/Posts/class-forms.php accepts field component metadata without validating script content. The React front-end in BuilderFormField.jsx renders the stored values back into the DOM without contextual escaping. The combination produces a classic stored XSS sink.
Attack Vector
An attacker authenticates to WordPress with a contributor account. The attacker crafts a form containing a malicious payload embedded in the meta[kaliforms_field_components] field configuration. The payload is saved to the database through the plugin's save handler. When an editor, administrator, or site visitor loads a page that references the form, the browser parses and executes the injected script. Attackers can leverage this to hijack sessions, perform actions with the victim's privileges, or plant additional backdoors. No user interaction beyond visiting the page is required. See the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2026-9107
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or HTML event handlers stored inside kaliforms_field_components post meta values.
- New or modified WordPress form posts created by contributor-level accounts shortly before administrator session anomalies.
- Outbound requests from admin browsers to unfamiliar domains immediately after loading a Kali Forms page.
Detection Strategies
- Query the WordPress wp_postmeta table for meta_key = 'kaliforms_field_components' and search values for script tags, onerror, onload, and encoded JavaScript payloads.
- Review WordPress audit logs for form creation or edits by low-privilege users, then correlate with subsequent admin activity.
- Inspect network telemetry from workstations used by WordPress administrators for anomalous cross-origin requests originating from the site domain.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture post meta changes and user role usage.
- Deploy a Web Application Firewall (WAF) with rules that block script content in form builder parameters.
- Alert on installations of Kali Forms plugin versions at or below 2.4.13 across managed WordPress sites.
How to Mitigate CVE-2026-9107
Immediate Actions Required
- Update the Kali Forms plugin to version 2.4.14 or later on every WordPress site that uses it.
- Audit contributor, author, and editor accounts, and remove any that are unused or unrecognized.
- Scan existing forms and post meta for stored script payloads and remove malicious entries.
Patch Information
The vendor addressed the flaw in Kali Forms 2.4.14. The relevant code changes are documented in the WordPress Plugin Change Log between tags 2.4.13 and 2.4.14. Administrators should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Restrict form creation and editing to trusted administrator accounts until the plugin is updated.
- Disable open user registration and remove contributor privileges from untrusted accounts.
- Deploy WAF rules that filter <script>, javascript:, and event handler patterns in meta[kaliforms_field_components] submissions.
# Update Kali Forms via WP-CLI
wp plugin update kali-forms --version=2.4.14
# Verify the installed version
wp plugin get kali-forms --field=version
# List contributor accounts for review
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
