Kali Forms — Contact Form & Drag-and-Drop Builder

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 66% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

16 of the last 25 four- and five-star reviews came from accounts created within a month of posting the review.

Registering a wp.org account just to leave a review is common and often entirely legitimate. The share here is unusually high for the sample, so it's worth keeping in mind while reading the reviews.

1. ★★★★★ st1nkym00

   11mo ago

   What a great and easy to use plugin for form building. It works perfectly

   Read on wp.org ↗
2. ★★★★★ Mac Boris Perc

   1.4y ago

   Easy to use – best extra premium options.

   Read on wp.org ↗
3. ★★★★★ accinformer

   2.0y ago

   Excelent

   Read on wp.org ↗
4. ★★★★★ yondaine

   2.3y ago

   I’ve been testing Kali Forms for a few months now and it works great. It’s easy to set up. My experience is based on the free version.

   Read on wp.org ↗
5. ★★★★★ piecko

   2.3y ago

   I recommend. Great plugin

   Read on wp.org ↗
6. ★★★★★ torsten3d

   2.4y ago

   I use it on a lot of sites. Creation is very intuitive, and it has some cool features in the ProVersion, some others might miss (signature field)Special mention: the solid honeypot option is very good. I never needed a captcha here.

   Read on wp.org ↗
7. ★★★★★ Andi

   2.8y ago

   And the Support Team is also very great!

   Read on wp.org ↗
8. ★★★★★ identtydev

   2.8y ago

   Great plugin to use for your forms. The builder is easy to use and if u need anything, the support will help you within a day.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.4.16 2.4.16
2. — Version 2.4.15 2.4.14 – Security: Fixed a bug that did not allow form builder to render properly 2.4.15
3. — Version 2.4.13 2.4.12 – Security: Sanitize form builder meta fields exposed via the WordPress REST API to prevent stored XSS in the admin form builder 2.4.11 – Security: added turnstile and recaptcha verification during the form proces 2.4.13
4. — Version 2.4.9 2.4.9
5. — Version 2.4.8 2.4.7 – Updated reaadme files – Changed text domain to match the slug – Removed certain features as requested by WordPress.org 2.4.6 – Added better handling for file upload fields in the form entries view and placeholder 2.4.8
6. — Version 2.4.5 2.4.5

18 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 8.1 Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter ↗
   2026-07-31 CVE-2026-16144 Improper Control of Generation of Code ('Code Injection') Affects <= 2.4.20 Patched in 2.4.21
2. High · 7.2 Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-27 CVE-2026-65446 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.18 Patched in 2.4.19
3. High · 8.1 Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.18 - Authenticated (Subscriber+) Arbitrary File Deletion ↗
   2026-07-22 CVE-2026-59542 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 2.4.18 Patched in 2.4.19
4. High · 7.2 Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value ↗
   2026-07-16 CVE-2026-15395 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.18 Patched in 2.4.19
5. Medium · 6.4 Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter ↗
   2026-06-30 CVE-2026-9107 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.13 Patched in 2.4.14
6. Medium · 4.3 Kali Forms <= 2.4.16 - Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure ↗
   2026-06-24 CVE-2026-11580 Authorization Bypass Through User-Controlled Key Affects <= 2.4.16 Patched in 2.4.17
7. Medium · 5.3 Kali Forms <= 2.4.16 - Missing Authorization to Unauthenticated Media File Upload ↗
   2026-06-24 CVE-2026-11579 Missing Authorization Affects <= 2.4.16 Patched in 2.4.17
8. Critical · 9.8 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process ↗
   2026-03-20 CVE-2026-3584 Improper Control of Generation of Code ('Code Injection') Affects <= 2.4.9 Patched in 2.4.10
9. Medium · 4.3 Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure ↗
   2026-02-17 CVE-2026-1860 Missing Authorization Affects <= 2.4.8 Patched in 2.4.9
10. Medium · 6.4 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-04-25 CVE-2025-3201 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.2 Patched in 2.4.3
11. High · 7.6 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation ↗
    2024-02-19 CVE-2024-1217 Missing Authorization Affects <= 2.3.41 Patched in 2.3.42
12. Medium · 4.3 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization ↗
    2024-02-19 CVE-2024-1218 Missing Authorization Affects <= 2.3.41 Patched in 2.3.42
13. Medium · 6.5 Contact Form builder with drag & drop - Kali Forms <= 2.3.36 - Insecure Direct Object Reference ↗
    2024-01-17 CVE-2024-22305 Authorization Bypass Through User-Controlled Key Affects <= 2.3.36 Patched in 2.3.37
14. Medium · 5.3 Contact Form builder with drag & drop - Kali Forms <= 2.3.27 - Missing Authorization via Contact Form ↗
    2023-10-16 CVE-2023-46083 Missing Authorization Affects <= 2.3.27 Patched in 2.3.28
15. Medium · 6.5 Contact Form builder with drag & drop - Kali Forms <= 2.3.28 - Missing Authorization via get_log ↗
    2023-10-06 CVE-2023-45275 Missing Authorization Affects <= 2.3.28 Patched in 2.3.29
16. High · 8.6 Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion ↗
    2020-08-21 CVE-2020-36712 Missing Authorization Affects < 2.1.2 Patched in 2.1.2
17. High · 7.1 Kali Forms <= 2.1.1 - Missing Authorization to Settings Update ↗
    2020-08-21 CVE-2020-36720 Missing Authorization Affects < 2.1.2 Patched in 2.1.2
18. High · 8.8 Kali Forms <= 2.1.1 - Cross-Site Request Forgery ↗
    2020-08-21 CVE-2020-36717 Cross-Site Request Forgery (CSRF) Affects < 2.1.2 Patched in 2.1.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 6 languages, 2 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-03-25 20K+ → 10K+ down after 764 days in tier
2. 2024-02-20 30K+ → 20K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz 500K+ installs · 4.7★ · 4 shared tags A
• Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 300K+ installs · 4.8★ · 4 shared tags A
• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 5M+ installs · 4.8★ · 3 shared tags A
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700K+ installs · 4.8★ · 3 shared tags A
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder 600K+ installs · 4.8★ · 3 shared tags A
• Ninja Forms – The Contact Form Builder That Grows With You 600K+ installs · 4.4★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Kali Forms — Contact Form & Drag-and-Drop Builder into a readme, a review or a deck. It updates itself.

Kali Forms — Contact Form & Drag-and-Drop Builder: 10K+ active installs, 4.8★ (89 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/kali-forms