CVE-2026-106649
UnknownSummary
The Kali Forms — Contact Form & Drag-and-Drag Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration. This code is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
Risk Assessment
This allows a low-privileged attacker (author) to hijack an administrator's session and perform actions on their behalf, potentially leading to full site compromise.
Recommendation
Update the Kali Forms plugin to version 2.4.29 or later. Additionally, restrict author-level roles to trusted users.
Other vulnerabilities in Kali Forms WordPress plugin
See all- CVE-2026-107343Medium
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
- CVE-2026-107342Medium
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
Original NVD description (English source)
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS