{"id":"CVE-2026-106649","kind":"vulnerability","aliases":["CVE-2026-106649"],"related":[],"title":"Kali Forms WordPress plugin: authors can store JavaScript that runs for admins","description":"The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.","summary":"The Kali Forms contact form plugin for WordPress, before version 2.4.29, does not stop users with author-level access from saving arbitrary JavaScript in a form button's configuration. That script runs in the browser of anyone who clicks the button, including an administrator, letting an attacker act with that person's session.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kali-forms","package","self-hosted","wordpress"],"not_affected_if":["no-untrusted-authors","plugin-not-installed","version-2.4.29-or-later"],"how_to_check":"- Check the installed Kali Forms plugin version in the WordPress admin Plugins screen; versions below `2.4.29` are listed as affected.\n- Review form button settings for unexpected script content if authors have had access.","fix":"- Kali Forms: upgrade to `2.4.29` or later.","status":"open","published_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:26:37+00:00","updated_at":"2026-11-04T06:26:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:37Z","model":"claude-haiku-5-5","output":{"fix":"- Kali Forms: upgrade to `2.4.29` or later.","reach":"internet","title":"Kali Forms WordPress plugin: authors can store JavaScript that runs for admins","impact":"medium","summary":"The Kali Forms contact form plugin for WordPress, before version 2.4.29, does not stop users with author-level access from saving arbitrary JavaScript in a form button's configuration. That script runs in the browser of anyone who clicks the button, including an administrator, letting an attacker act with that person's session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kali-forms","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in admin sessions, enabling account takeover on the site","analyst_note":"","how_to_check":"- Check the installed Kali Forms plugin version in the WordPress admin Plugins screen; versions below `2.4.29` are listed as affected.\n- Review form button settings for unexpected script content if authors have had access.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.4.29-or-later","no-untrusted-authors"],"who_is_affected":"Sites running the Kali Forms WordPress plugin before 2.4.29 where users with author-level access or higher can edit forms. Exposure comes from the form button configuration, which is rendered into pages that other users open, so sites with only trusted administrators editing forms carry less risk. Sites that do not use this plugin can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4142,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106649':15A,18A '-2026':14A,17A '2.4.29':37B,94C 'access':46B,103C 'act':75B 'admin':12A 'administr':71B,139C 'anyon':64B 'arbitrari':49B,108C 'attack':74B 'author':5A,44B,101C 'author-level':43B,100C 'browser':62B,128C 'builder':90C 'button':54B,68B,113C,136C 'click':66B,134C 'configur':56B,114C 'contact':30B,84C 'context':123C 'cve':13A,16A 'drag':87C 'drag-and-drop':86C 'drop':89C 'execut':122C 'form':2A,21B,29B,31B,53B,83C,85C,112C 'host':25B 'includ':69B,137C 'javascript':8A,50B,109C,121C 'kali':1A,20B,28B,82C 'kali-form':19B 'later':117C 'let':72B 'level':45B,102C 'output':118C 'packag':22B 'person':78B 'plugin':4A,32B,92C 'prevent':97C 'run':10A,59B,125C 'save':48B 'script':58B 'self':24B 'self-host':23B 'session':80B,129C 'stop':40B 'store':7A,107C 'user':41B,98C,132C 'version':36B 'wordpress':3A,26B,34B,91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Kali Forms WordPress plugin before 2.4.29 where users with author-level access or higher can edit forms. Exposure comes from the form button configuration, which is rendered into pages that other users open, so sites with only trusted administrators editing forms carry less risk. Sites that do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["kaliforms","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106649","severity":null,"published_at":"2026-11-04T06:16:57+00:00","modified_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}