CVE-2026-106649: Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kali Forms — Contact Form & Drag-and-Drop Builderto a version that resolves this vulnerability.Fixed in 2.4.29
Event History
Frequently Asked Questions
Who is exposed to exploitation?
WordPress sites using Kali Forms versions before 2.4.29 are affected if users have author-level access or higher. An administrator or other user must later click the configured form button for the stored JavaScript to execute in that user's browser session.
What access does an attacker need?
The attacker needs an authenticated WordPress account with at least author-level permissions and the ability to configure a form button action. Exploitation also requires persuading or waiting for another user to click the malicious button.
What should be prioritized for remediation?
Update Kali Forms to version 2.4.29 or later. Until updating is possible, restrict author-level and higher access to trusted users and review form button configurations for unexpected JavaScript or suspicious actions.
How can administrators check for possible exploitation?
Review Kali Forms form button configurations created or modified by author-level or higher users, especially for arbitrary JavaScript in button actions. Also review which users have author-level and higher WordPress roles, since those accounts can create the malicious configuration.