NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-11581
Summary

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.

Publication Date June 30, 2026, 4:16 p.m.
Registration Date July 1, 2026, 4:23 a.m.
Last Update June 30, 2026, 11:14 p.m.
CVSS3.1 : MEDIUM
スコア 5.9
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC)
攻撃に必要な特権レベル(PR)
利用者の関与(UI)
影響の想定範囲(S) 変更あり
機密性への影響(C)
完全性への影響(I)
可用性への影響(A)
Related information, measures and tools
Common Vulnerabilities List