CVE-2026-48196: WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vector is network-accessible, but exploitation requires an attacker to have low-level privileges and to induce user interaction. The available data does not identify the specific WordPress role or permission required.

Q: What is the potential impact of successful exploitation?

Successful exploitation can store malicious script content that executes when a user views the affected page or content. The listed impact includes low confidentiality, integrity, and availability effects, with scope changed.

Q: Which Kali Forms versions are affected?

Kali Forms versions through 2.4.27 are affected. The provided data does not identify a fixed version.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Kali Forms plugin to a version that resolves this vulnerability.
Fixed in 2.4.28

Event History

Oct 29, 2026

CVE Published

via MITRE·01:04 PM

Data Sourced

via MITRE·01:04 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vector is network-accessible, but exploitation requires an attacker to have low-level privileges and to induce user interaction. The available data does not identify the specific WordPress role or permission required.

What is the potential impact of successful exploitation?

Successful exploitation can store malicious script content that executes when a user views the affected page or content. The listed impact includes low confidentiality, integrity, and availability effects, with scope changed.

Which Kali Forms versions are affected?