Unauthenticated Cross Site Scripting in the Kali Forms plugin versions up to 2.4.18 allows an attacker to inject malicious script into form responses that are rendered in the browser of any user who views the affected page. This flaw can lead to theft of user credentials, session hijacking, defacement, or the execution of arbitrary code in the context of the site. The weakness is a classic input validation and output encoding failure (CWE‑79).

The vulnerability affects WordPress sites that have installed the Kali Forms plugin from WP Chill, any version 2.4.18 or earlier. Any site using that plugin is at risk, regardless of whether the site restricts form usage to logged‑in users or leaves it open to the public.

The CVSS score of 7.1 indicates a high severity for this vulnerability. An EPSS score of < 1% indicates a very low exploitation probability, and it is not listed in the CISA KEV catalog, suggesting that there are currently no widely known public exploits. Based on the description, the attack vector and its impact are inferred: the primary attack vector is understood as unauthenticated submission of crafted input to a form field, which is then reflected verbatim in the HTML output of the site. An attacker only needs to place malicious content in a form on a target website and have a victim view the resulting page to exploit the flaw.