CVE-2026-15395 is a stored cross-site scripting vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin by wpchill. The vulnerability arises from insufficient input sanitization and output escaping of the 'digitalSignature' field value. Attackers can inject arbitrary web scripts that persist and execute in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 2.4.18. Exploitation requires no privileges or user interaction beyond accessing a page with the vulnerable form, as the required nonce is publicly accessible.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected pages. This can lead to information disclosure and manipulation of client-side data (confidentiality and integrity impacts). There is no direct impact on availability. The vulnerability has a CVSS 3.1 base score of 7.2 (High severity) reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict publishing of forms using the vulnerable plugin and avoid exposing the affected 'digitalSignature' field. Monitor vendor channels for updates and apply patches promptly once released.