This vulnerability (CVE-2026-65446) is an instance of CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). It affects Kali Forms plugin by WP Chill in versions up to 2.4.18. The flaw allows unauthenticated attackers to inject malicious scripts into web pages generated by the plugin, potentially leading to execution of arbitrary scripts in the context of the victim's browser. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can result in partial loss of confidentiality, integrity, and availability of the affected web application. An attacker could execute arbitrary scripts in the context of users visiting the vulnerable site, potentially leading to session hijacking, defacement, or other malicious actions. Since the vulnerability is exploitable without authentication, it poses a significant risk to sites using affected versions of Kali Forms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling or restricting the use of Kali Forms plugin, or implementing web application firewall (WAF) rules to detect and block XSS payloads targeting the plugin. Monitor vendor channels for updates and apply official patches promptly once available.