{"id":"CVE-2026-48196","kind":"vulnerability","aliases":["CVE-2026-48196"],"related":[],"title":"Kali Forms WordPress plugin: stored XSS through 2.4.27","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.","summary":"Kali Forms, a WordPress form builder plugin, fails to sanitize some input before rendering it on pages. An attacker who can submit that input can store a script that runs in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kali-forms","package","wordpress"],"not_affected_if":["plugin-not-installed","version-above-2.4.27"],"how_to_check":"- Check the installed Kali Forms plugin version in the WordPress admin under Plugins, or with `wp plugin get kali-forms --field=version`\n- Confirm whether the installed version is `2.4.27` or earlier","fix":"- Kali Forms: move to a version later than `2.4.27`; the sources do not name the exact fixed release","status":"open","published_at":"2026-10-29T13:17:12+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:39+00:00","updated_at":"2026-10-29T13:25:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T13:25:39Z","model":"claude-haiku-5-5","output":{"fix":"- Kali Forms: move to a version later than `2.4.27`; the sources do not name the exact fixed release","reach":"internet","title":"Kali Forms WordPress plugin: stored XSS through 2.4.27","impact":"medium","summary":"Kali Forms, a WordPress form builder plugin, fails to sanitize some input before rendering it on pages. An attacker who can submit that input can store a script that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kali-forms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site.","analyst_note":"Confirm the fixed version and which input or permission level triggers the stored XSS; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-48196 and the plugin's changelog.","how_to_check":"- Check the installed Kali Forms plugin version in the WordPress admin under Plugins, or with `wp plugin get kali-forms --field=version`\n- Confirm whether the installed version is `2.4.27` or earlier","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-2.4.27"],"who_is_affected":"Sites running Kali Forms version 2.4.27 or earlier are affected. The flaw is stored XSS, so the risk is highest where form content or submissions are shown to other users or admins. Sites without the plugin, or running a later version, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4122,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-48196':11A,14A '2.4.27':8A,84C 'affect':78C 'allow':74C 'attack':38B 'browser':53B 'builder':25B 'cross':63C 'cross-sit':62C 'cve':9A,12A 'fail':27B 'form':2A,17B,21B,24B,70C,73C,80C 'generat':61C 'improp':54C 'input':31B,43B,57C 'issu':77C 'kali':1A,16B,20B,69C,72C,79C 'kali-form':15B,71C 'kaliform':68C 'n/a':82C 'neutral':55C 'packag':18B 'page':36B,60C 'plugin':4A,26B 'render':33B 'run':49B 'sanit':29B 'script':47B,65C 'site':64C 'store':5A,45B,75C 'submit':41B 'visitor':52B 'vulner':66C 'web':59C 'wordpress':3A,19B,23B 'xss':6A 'xss.this':76C","nicknames":[],"mitigations":[],"who_affected":"Sites running Kali Forms version 2.4.27 or earlier are affected. The flaw is stored XSS, so the risk is highest where form content or submissions are shown to other users or admins. Sites without the plugin, or running a later version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48196","severity":null,"published_at":"2026-10-29T13:17:12+00:00","modified_at":"2026-10-29T13:17:12+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}