Kali Forms

Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.4.27.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The CNA vector requires victim interaction; the specific interaction is not disclosed. The structured affected range is <= 2.4.27.

Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.4.27.

Kali Forms through 2.4.23 exposes an affected operation without the authorization it requires. An unauthenticated attacker can invoke that protected operation and change plugin or site data.

Kali Forms through 2.4.20 lets a submitted thisPermalink value replace a trusted callable placeholder and reach call_user_func() in _save_data(). An unauthenticated attacker can execute server-side code when the targeted form defines a field named thisPermalink, entryCounter or submission_link.

Kali Forms through 2.4.18 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin.

Kali Forms is affected by arbitrary file deletion. Exploitation requires an authenticated subscriber account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 2.4.18.

Kali Forms 2.4.18 and earlier stores digitalSignature field content without sufficient sanitization and later renders it without safe escaping. Because the form nonce is available on the public form, an unauthenticated attacker can submit persistent script that executes when the stored submission is viewed.

Kali Forms — Contact Form & Drag-and-Drop Builder is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.4.13.

Kali Forms is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Kali Forms is affected by broken access control. Exploitation requires an authenticated contributor account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

Contact Form builder with drag & drop for WordPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Kali Forms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Kali Forms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Contact Form builder with drag & drop for WordPress – Kali Forms is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Kali Forms is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Kali Forms is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Kali Forms is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.