Answer in brief
CVE-2026-11581 records a Medium severity (CVSS 5.9) vulnerability in Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption. The current sources do not mark it as known exploited. The current feed maps Unknown/Kali Forms — Contact Form & Drag-and-Drop Builder (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Kali Forms — Contact Form & Drag-and-Drop Builder (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Kali Forms — Contact Form & Drag-and-Drop Buildergeneric | >=0 <2.4.13 | 2.4.13 |
Published upstream
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-11581 records a Medium severity (CVSS 5.9) vulnerability in Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption. The current sources do not mark it as known exploited. The current feed maps Unknown/Kali Forms — Contact Form & Drag-and-Drop Builder (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Kali Forms — Contact Form & Drag-and-Drop Builder (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Kali Forms — Contact Form & Drag-and-Drop Buildergeneric | >=0 <2.4.13 | 2.4.13 |
Published upstream
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes in an administrator's session. A missing capability check in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13's post-duplication action additionally lets the Contributor publish the malicious form so an administrator renders it.
Quoted source text, attributed separately from HOL analysis.