CVE-2026-106649

— UNSCORED

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.

All references

https://wpscan.com/vulnerability/b8602baf-33b2-46b2-98c7-7d29a393faf3/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.