KF
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 5Low 0
Watch
Add Kali Forms — Contact Form & Drag-and-Drop Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-3584 | 9.8 | Mar 20 | Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process Affected: through 2.4.9 |
| CVE-2020-36717 | 8.8 | Jun 7 | Kali Forms <= 2.1.1 - Cross-Site Request Forgery Affected: before 2.1.2 |
| CVE-2026-16144 | 8.1 | Aug 1 | Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter Affected: through 2.4.20 |
| CVE-2026-15395 | 7.2 | Jul 17 | Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value Affected: through 2.4.18 |
| CVE-2020-36720 | 7.1 | Jun 7 | Kali Forms <= 2.1.1 - Missing Authorization to Settings Update Affected: before 2.1.2 |
| CVE-2026-9107 | 6.4 | Jul 1 | Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter Affected: through 2.4.13 |
| CVE-2024-1218 | 5.4 | Feb 20 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization Affected: through 2.3.41 |
| CVE-2020-36712 | 5.3 | Jun 7 | Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion Affected: before 2.1.2 |
| CVE-2026-1860 | 4.3 | Feb 18 | Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure Affected: through 2.4.8 |
| CVE-2024-1217 | 4.3 | Feb 20 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation Affected: through 2.3.41 |
Showing 10