CVE-2026-11581 describes a stored Cross-Site Scripting vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions prior to 2.4.13. The vulnerability arises because the plugin does not sanitize form field captions before outputting them as column headers in the administrator interface, enabling users with Contributor-level permissions to inject JavaScript code. Furthermore, the plugin lacks a capability check during the post-duplication process, allowing Contributors to publish malicious forms that administrators will view, triggering the XSS payload. This vulnerability requires at least Contributor-level access and user interaction (administrator viewing the form entries).

Successful exploitation allows an attacker with Contributor-level access to inject and store JavaScript code that executes in the context of an administrator's session. This can lead to partial compromise of confidentiality, integrity, and availability within the affected WordPress environment. The attacker can potentially perform actions with the administrator's privileges via the executed script. The CVSS score of 5.9 (medium severity) reflects the network attack vector, low attack complexity, required privileges at the Contributor level, and user interaction needed.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply the official fix once available. Until then, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Kali Forms plugin. Administrators should be cautious when viewing form entries and duplicated posts created by Contributors. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.