CVE-2026-15395

Name of the Vulnerable Software and Affected Versions Kali Forms — Contact Form & Drag-and-Drop Builder versions prior to 2.4.19

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. Attackers can inject arbitrary web scripts through the digitalSignature field value. These scripts execute whenever a user accesses the affected page. The attack is possible because the required form-submission nonce is publicly available on any page containing the form shortcode.

Recommendations As a temporary workaround, disable or replace the plugin until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.