# CVE-2026-9107: WPChill Kali Forms Stored XSS in kaliforms_field_components

Source: https://junglewise.ai/threats/cve-2026-9107-wpchill-kali-forms-stored-xss-in-kaliforms-field-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-9107 · Severity: medium · CVSS 6.4 · Published 2026-07-01

Kali Forms, a popular WordPress plugin used for creating contact forms, contains a security vulnerability that allows users with contributor-level access or higher to inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site administrators or the theft of sensitive session information.

Technologies: [WPChill Kali Forms — Contact Form & Drag-and-Drop Builder](https://junglewise.ai/threats/technologies/kali-forms-contact-form-drag-and-drop-builder). Vendors: [WPChill](https://junglewise.ai/threats/vendors/wpchill).

## Quick answers

**Is CVE-2026-9107 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9107 being exploited in the wild.

**How severe is CVE-2026-9107?** Medium severity, with a CVSS score of 6.4, published 1 July 2026.

**Which products and versions are affected?** WPChill Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.13.

**Is there a fix for CVE-2026-9107?** A patch was published on 2026-07-01: Patch released in version 2.4.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9107 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9107?** Check whether you run WPChill Kali Forms — Contact Form & Drag-and-Drop Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kali Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'meta[kaliforms_field_components]' parameter. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting arbitrary JavaScript into form metadata. When a user (including administrators) views the page where this metadata is rendered, the script executes in their browser context. The vulnerability exists in versions up to 2.4.13 and was addressed in version 2.4.14. The attack vector is network-based and requires low-level authentication but no user interaction from the victim beyond visiting the compromised page.

## Affected products

- WPChill Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.13

## Timeline

- 2026-07-01: advisory: NVD publication date
- 2026-07-01: patched: Patch released in version 2.4.14

## References

- [https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/Inc/Backend/Posts/class-forms.php](https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/Inc/Backend/Posts/class-forms.php)
- [https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/Inc/Backend/Posts/class-forms.php](https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/Inc/Backend/Posts/class-forms.php)
- [https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/resources/assets/js/forms/components/Builder/BuilderFormField.jsx](https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/resources/assets/js/forms/components/Builder/BuilderFormField.jsx)
- [https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/resources/assets/js/forms/components/Builder/BuilderFormField.jsx](https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.10/resources/assets/js/forms/components/Builder/BuilderFormField.jsx)
- [https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.11/Inc/Backend/Posts/class-forms.php](https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.11/Inc/Backend/Posts/class-forms.php)
- [https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.11/Inc/Backend/Posts/class-forms.php](https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.11/Inc/Backend/Posts/class-forms.php)
- [https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.11/resources/assets/js/forms/components/Builder/BuilderFormField.jsx](https://plugins.trac.wordpress.org/browser/kali-forms/tags/2.4.11/resources/assets/js/forms/components/Builder/BuilderFormField.jsx)