CVE-2026-9107

Name of the Vulnerable Software and Affected Versions Kali Forms — Contact Form & Drag-and-Drop Builder versions prior to 2.4.14

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the meta[kaliforms field components] parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update Kali Forms — Contact Form & Drag-and-Drop Builder to version 2.4.14 or later.