CVE-2026-106649 · Package
NO FIX YET · SEE WHAT TO DO
The Kali Forms contact form plugin for WordPress, before version 2.4.29, does not stop users with author-level access from saving arbitrary JavaScript in a form button's configuration. That script runs in the browser of anyone who clicks the button, including an administrator, letting an attacker act with that person's session.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Kali Forms WordPress plugin before 2.4.29 where users with author-level access or higher can edit forms. Exposure comes from the form button configuration, which is rendered into pages that other users open, so sites with only trusted administrators editing forms carry less risk. Sites that do not use this plugin can skip it.
Not affected if no-untrusted-authors, plugin-not-installed, version-2.4.29-or-later
Who cares kali-forms, self-hosted, wordpress
2.4.29 are listed as affected.2.4.29 or later.The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.