Junglewise Threat Intelligence

CVE-2026-9107: WPChill Kali Forms Stored XSS in kaliforms_field_components

CVE-2026-9107 · Severity: medium · CVSS 6.4 · Published 2026-07-01

Technologies: WPChill Kali Forms — Contact Form & Drag-and-Drop Builder. Vendors: WPChill.

Executive brief

Kali Forms, a popular WordPress plugin used for creating contact forms, contains a security vulnerability that allows users with contributor-level access or higher to inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site administrators or the theft of sensitive session information.

Technical details

The Kali Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'meta[kaliforms_field_components]' parameter. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting arbitrary JavaScript into form metadata. When a user (including administrators) views the page where this metadata is rendered, the script executes in their browser context. The vulnerability exists in versions up to 2.4.13 and was addressed in version 2.4.14. The attack vector is network-based and requires low-level authentication but no user interaction from the victim beyond visiting the compromised page.

Affected products

  • WPChill Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.13

Timeline

  • 2026-07-01: advisory: NVD publication date
  • 2026-07-01: patched: Patch released in version 2.4.14

References