{"id":"CVE-2026-106649","title":"Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action","summary":"The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-79"],"product":"Kali Forms — Contact Form & Drag-and-Drop Builder","affected":["kali_forms_contact_form_drag-and-drop_builder < 2.4.29"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-04T14:06:52.873030Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:22.799Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106649","references":[{"url":"https://wpscan.com/vulnerability/b8602baf-33b2-46b2-98c7-7d29a393faf3/"}],"tags":["cve.org"],"epss":0.00358,"epssPercentile":0.29707,"ingestedAt":"2026-11-05T21:36:00.373Z","slug":"CVE-2026-106649","body":"## Overview\n\nThe Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.\n\n## Affected\n\n- `kali_forms_contact_form_drag-and-drop_builder < 2.4.29`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}