A stored XSS flaw allows an attacker to inject malicious scripts into form input fields in the Kali Forms plugin. When the content is viewed, the scripts execute in the context of the site, compromising user sessions, defacing pages, and allowing sensitive data exfiltration. The weakness stems from improper input sanitization, classified as CWE‑79.

The vulnerability affects the Kali Forms plugin for WordPress, versions up to and including 2.4.27. Any site running WordPress with this plugin in that version range is exposed.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The plugin is not listed in the CISA KEV catalog, suggesting no known public exploitation. The likely attack vector is through normal form submission by an unsuspecting user, with the attacker controlling the form content.