Skip to content
PluginCanary

Kali Forms

Kali Forms - Contact Form & Drag-and-Drop Builder
by WP Chill · 10,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 29 Oct 2026, 148 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for Kali Forms
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is Kali Forms still maintained?
Yes. Last release 29 Oct 2026, 148 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns Kali Forms, and has it changed hands?
No change recorded. Main committer kaliforms since Jul 2019. 4 Nov 2026 · SVN log
Was Kali Forms removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Kali Forms safe?
25 known vulnerabilities, all fixed (latest in 2.4.30). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Kali Forms update safe to install?
No ownership change before 2.4.31. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master21 Jun 2019 to 21 Jun 2019, 1 commits
kaliforms1 Jul 2019 to 29 Oct 2026, 169 commits

2 committers recorded. No ownership change since 2019.

Maintenance

Last release
6 days ago
Releases, 24 months
148
Tested up to
7.0 vs 7.1
Requires PHP
5.6 supported 8.2+
Releases per quarter
Releases per quarter for Kali Forms
Q1 20240
Q2 20240
Q3 20242
Q4 20240
Q1 2025120
Q2 20251
Q3 20251
Q4 20252
Q1 20264
Q2 20267
Q3 20267
Q4 20266

Last release 29 Oct 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Average rating per quarter for Kali Forms
Q4 20235.0
Q1 20245.0
Q2 20245.0
Q3 20245.0
Q2 20255.0
Q3 20255.0

Average rating stayed at 5.0 between Q4 2023 and Q3 2025.

Rating distribution
5 star84
4 star1
3 star1
2 star1
1 star2
Latest low reviews

Security record

17 vulnerabilities in 24 months (25 on record), all patched (latest fixed in 2.4.30).

Show 25 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Kali Forms <= 2.4.29 - Missing Authorization4.3<= 2.4.292.4.30Patched before disclosure
30 Oct 2026Kali Forms <= 2.4.29 - Authenticated (Subscriber+) Information Exposure4.3<= 2.4.292.4.30Patched before disclosure
29 Oct 2026Kali Forms - Contact Form & Drag-and-Drop Builder <= 2.4.27 - Missing Authorization5.3<= 2.4.272.4.28Patched before disclosure
29 Oct 2026Kali Forms - Contact Form & Drag-and-Drop Builder <= 2.4.27 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.4.272.4.28Patched before disclosure
29 Oct 2026Kali Forms - Contact Form & Drag-and-Drop Builder <= 2.4.27 - Missing Authorization4.3<= 2.4.272.4.28Patched before disclosure
26 Aug 2026Kali Forms - Contact Form & Drag-and-Drop Builder <= 2.4.23 - Missing Authorization5.3<= 2.4.232.4.24Patched before disclosure
31 Jul 2026Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter8.1<= 2.4.202.4.21Patched before disclosure
27 Jul 2026Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.4.182.4.19Patched before disclosure
22 Jul 2026Kali Forms - Contact Form & Drag-and-Drop Builder <= 2.4.18 - Authenticated (Subscriber+) Arbitrary File Deletion8.1<= 2.4.182.4.19Patched before disclosure
16 Jul 2026Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value7.2<= 2.4.182.4.19Patched before disclosure
30 Jun 2026Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter6.4<= 2.4.132.4.14Patched before disclosure
24 Jun 2026Kali Forms <= 2.4.16 - Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure4.3<= 2.4.162.4.17Patched before disclosure
24 Jun 2026Kali Forms <= 2.4.16 - Missing Authorization to Unauthenticated Media File Upload5.3<= 2.4.162.4.17Patched before disclosure
9 Jun 2026Kali Forms <= 2.4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.4.122.4.13Patched before disclosure
20 Mar 2026Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process9.8<= 2.4.92.4.10Patched before disclosure
17 Feb 2026Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure4.3<= 2.4.82.4.9Patched before disclosure
25 Apr 2025Contact Form builder with drag & drop for WordPress - Kali Forms <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.4.22.4.3Patched before disclosure
19 Feb 2024Contact Form builder with drag & drop for WordPress - Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation7.6<= 2.3.412.3.42393
19 Feb 2024Contact Form builder with drag & drop for WordPress - Kali Forms <= 2.3.41 - Missing Authorization4.3<= 2.3.412.3.42393
17 Jan 2024Contact Form builder with drag & drop - Kali Forms <= 2.3.36 - Insecure Direct Object Reference6.5<= 2.3.362.3.37426
16 Oct 2023Contact Form builder with drag & drop - Kali Forms <= 2.3.27 - Missing Authorization via Contact Form5.3<= 2.3.272.3.28519
6 Oct 2023Contact Form builder with drag & drop - Kali Forms <= 2.3.28 - Missing Authorization via get_log6.5<= 2.3.282.3.29529
21 Aug 2020Kali Forms <= 2.1.1 - Cross-Site Request Forgery8.8< 2.1.22.1.21670
21 Aug 2020Kali Forms <= 2.1.1 - Missing Authorization to Settings Update7.1< 2.1.22.1.21670
21 Aug 2020Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion8.6< 2.1.22.1.21670

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Kali Forms
4 May 2026371
11 May 2026750
18 May 20261,137
25 May 2026746
1 Jun 2026565
8 Jun 20268,405
15 Jun 202615,631
22 Jun 202615,482
29 Jun 20261,596
6 Jul 20261,383
13 Jul 20268,986
20 Jul 20267,041
27 Jul 20263,439
3 Aug 202616,113
10 Aug 20261,790
17 Aug 20261,010
24 Aug 20268,641
31 Aug 20261,386
7 Sep 2026969
14 Sep 20261,275
21 Sep 20269,141
28 Sep 20261,259
5 Oct 20268,397
12 Oct 20261,347
19 Oct 20268,867
26 Oct 202619,665
2 Nov 2026377

Weekly downloads over the last 4 weeks are 40% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Online FormsScore 100 · 20,000+RTMFormScore 98 · 30,000+FormLayerScore 96 · 100,000+Snow Monkey FormsScore 96 · 30,000+Contact Form by BestWebSoftScore 93 · 30,000+

Facts

Version2.4.31
AuthorWP Chill
Added1 Jul 2019
Last updated29 Oct 2026
Active installs10,000+
Requires WordPress5.5
Tested up to7.0.8
Requires PHP5.6
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms, contact form, form builder, payment form, stripe payment

Other plugins by this author: Modula Image Gallery - Photo Grid & Video Gallery, Download Monitor, Strong Testimonials, Remove Footer Credit, Image Photo Gallery Final Tiles Grid, Passster - Password Protect Pages and Content, Htaccess File Editor - Easily Edit, Backup, Restore .htaccess file, CPO Content Types, Gallery PhotoBlocks, RSVP and Event Management, Qyrr - simply and modern QR-Code creation, Wider Admin Menu

Questions

Is Kali Forms still maintained?

Yes. Last release 29 Oct 2026, 148 releases in the last 24 months.

Who owns Kali Forms, and has it changed hands?

No change recorded. Main committer kaliforms since Jul 2019.

Was Kali Forms removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Kali Forms safe?

25 known vulnerabilities, all fixed (latest in 2.4.30). Not on the exploited list.

Is the latest Kali Forms update safe to install?

No ownership change before 2.4.31. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue