Kali Forms
Approved changes feed: RSS · Atom
cpe:2.3:a:kaliforms:kali_forms:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Kaliforms (631d8594-6fe0-597a-8e42-edcf02e6cb2c) |
|---|---|
| Product | Kali Forms (019150c3-cf40-5326-979b-34b4a0a6ff74) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-3201 |
vulnerable | 2026-06-08 07:23:08.432895 |
Kali Forms < 2.4.3 - Contributor+ Stored XSS
The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
Published: 2025-05-16T06:00:03.892Z
Updated: 2025-05-16T17:29:50.710Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22305 |
vulnerable | 2026-06-08 06:29:34.476855 |
WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)
HIGH (7.5)
Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.
Published: 2024-01-31T11:49:29.473Z
Updated: 2026-04-28T16:09:09.816Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-36720 |
vulnerable | 2026-06-08 05:25:49.464989 |
Kali Forms <= 2.1.1 - Missing Authorization to Settings Update
HIGH (7.1)
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
Published: 2023-06-07T01:51:34.466Z
Updated: 2026-04-08T17:11:49.953Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-36717 |
vulnerable | 2026-06-08 05:25:49.459013 |
Kali Forms <= 2.1.1 - Cross-Site Request Forgery
HIGH (8.8)
The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handling throughout the plugin's function. This makes it possible for unauthenticated attackers to access the plugin's administrative functions via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2023-06-07T01:51:36.167Z
Updated: 2026-04-08T17:13:19.701Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-36712 |
vulnerable | 2026-06-08 05:25:49.447889 |
Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion
HIGH (8.6)
The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter.
Published: 2023-06-07T01:51:31.644Z
Updated: 2026-04-08T17:09:24.984Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.