The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions prior to 2.4.13 contain a stored Cross-Site Scripting (XSS) vulnerability. Specifically, the plugin does not sanitize the caption of form fields before outputting them as column headers on the administrator's form-entries screen, enabling users with Contributor-level access or above to inject and store JavaScript code. Furthermore, the plugin lacks a proper capability check in the post-duplication action, allowing Contributors to publish malicious forms that will be rendered by administrators, potentially leading to script execution in administrator sessions.

An attacker with Contributor-level access can inject malicious JavaScript that executes in the context of an administrator's session. This can lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges. The vulnerability arises from improper sanitization and missing capability checks, increasing the risk of unauthorized code execution within the administrative interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to form creation and duplication. Avoid rendering untrusted form captions in administrator interfaces or apply manual sanitization as a temporary measure.