WordPress plugin
Kali Forms — Contact Form & Drag-and-Drop Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 27 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High8
- Medium18
- Low0
All Kali Forms — Contact Form & Drag-and-Drop Builder vulnerabilities
- Medium5.3Missing Authorization
≤2.4.31Update to 2.4.32
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤2.4.28Update to 2.4.29
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤2.4.29Update to 2.4.30
- Medium4.3Missing Authorization
≤2.4.29Update to 2.4.30
- Medium5.3Missing Authorization
≤2.4.27Update to 2.4.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.27Update to 2.4.28
- Medium4.3Missing Authorization
≤2.4.27Update to 2.4.28
- Medium5.3Missing Authorization
≤2.4.23Update to 2.4.24
- High8.1Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
≤2.4.20Update to 2.4.21
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.4.18Update to 2.4.19
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤2.4.18Update to 2.4.19
- High7.2Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value
≤2.4.18Update to 2.4.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter
≤2.4.13Update to 2.4.14
- Medium5.3Missing Authorization to Unauthenticated Media File Upload
≤2.4.16Update to 2.4.17
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure
≤2.4.16Update to 2.4.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.12Update to 2.4.13
- Critical9.8Unauthenticated Remote Code Execution via form_process
≤2.4.9Update to 2.4.10
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure
≤2.4.8Update to 2.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.4.2Update to 2.4.3
- Medium4.3Missing Authorization
≤2.3.41Update to 2.3.42
- High7.6Missing Authorization to Arbitrary Plugin Deactivation
≤2.3.41Update to 2.3.42
- Medium6.5Kali Forms <= 2.3.36 - Insecure Direct Object Reference
≤2.3.36Update to 2.3.37
- Medium5.3Kali Forms <= 2.3.27 - Missing Authorization via Contact Form
≤2.3.27Update to 2.3.28
- Medium6.5Kali Forms <= 2.3.28 - Missing Authorization via get_log
≤2.3.28Update to 2.3.29
- High8.6Unauthenticated Arbitrary Post Deletion
<2.1.2Update to 2.1.2
- High8.8Cross-Site Request Forgery
<2.1.2Update to 2.1.2
- High7.1Missing Authorization to Settings Update
<2.1.2Update to 2.1.2
Kali Forms — Contact Form & Drag-and-Drop Builder: common questions
Does Kali Forms — Contact Form & Drag-and-Drop Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 27 known vulnerabilities in Kali Forms — Contact Form & Drag-and-Drop Builder: 1 critical, 8 high, 18 medium. None are known to affect version null.
How do I check which version of Kali Forms — Contact Form & Drag-and-Drop Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Kali Forms — Contact Form & Drag-and-Drop Builder vulnerability?
CVE-2026-125448, published Nov 11, 2026: Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.31 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any Kali Forms — Contact Form & Drag-and-Drop Builder vulnerability listed in CISA KEV?
No. None of the known Kali Forms — Contact Form & Drag-and-Drop Builder vulnerabilities is currently listed in the CISA KEV catalog.