CVE-2026-9107

MediumCVSS 6.4/10Last modified Jul 1, 2026

Description

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_components]' parameter in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2026
Last modified: Jul 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-910724.4The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own u CVE-2026-910736.8The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, all CVE-2026-910746.8The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, whi CVE-2026-910765.3The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notifica CVE-2026-910772.7The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting CVE-2026-910788.2The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on ac CVE-2026-910798.5Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist va CVE-2026-91087.5A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files.CVE-2026-910807.5webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhau CVE-2026-910815.8Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make o CVE-2026-910856.3Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). S CVE-2026-910866.3A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filt