kali_forms_contact_form_drag-and-drop_builder vulnerabilities
CVEs whose affected-version data names the kali_forms_contact_form_drag-and-drop_builder package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-106649Medium· 6.8Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a…
CVE-2026-107342Medium· 4.3Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available t…
CVE-2026-107343Medium· 4.3Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user…