Advisories · Technology
wpchill Kali Forms — Contact Form & Drag-and-Drop Builder.
Every CVE that names wpchill Kali Forms — Contact Form & Drag-and-Drop Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Code injection
- CVSS 7.2 High
Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Code injection
- CVSS 4.3 Medium
Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Broken access control
- CVSS 4.3 Medium
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Broken access control
- CVSS 7.6 High
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Broken access control
- CVSS 8.8 High
Kali Forms <= 2.1.1 - Cross-Site Request Forgery
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
Kali Forms <= 2.1.1 - Missing Authorization to Settings Update
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Broken access control
- CVSS 8.6 High
Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Broken access control