WPChill Kali Forms — Contact Form & Drag-and-Drop Builder

• CVE-2026-16144 High 8.1 Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter 1.2%
• CVE-2026-15395 High 7.2 Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value 0.4%
• CVE-2026-9107 Medium 6.4 Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter 0.4%
• CVE-2026-3584 Critical 9.8 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process 7.4%
• CVE-2026-1860 Medium 4.3 Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure 0.3%
• CVE-2024-1218 Medium 4.3 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization 0.3%
• CVE-2024-1217 High 7.6 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation 0.3%
• CVE-2020-36717 High 8.8 Kali Forms <= 2.1.1 - Cross-Site Request Forgery 0.5%
• CVE-2020-36720 High 7.1 Kali Forms <= 2.1.1 - Missing Authorization to Settings Update 0.8%
• CVE-2020-36712 High 8.6 Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion 0.7%