CVE-2025-3201: Kaliforms Kali Forms

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.

Affected products

• Kaliforms Kali Forms: before 2.4.3 (fixed in 2.4.3)

Published 2025-05-16. Last modified 2026-06-17.