{"affected":[{"defaultStatus":"unaffected","product":"Kali Forms — Contact Form & Drag-and-Drop Builder","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.4.29","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-106649","cwes":["CWE-79"],"description":"The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/b8602baf-33b2-46b2-98c7-7d29a393faf3/"}],"kev":null,"metrics":[],"modifiedAt":1793772024533,"publishedAt":1793772024533,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/b8602baf-33b2-46b2-98c7-7d29a393faf3/"}],"remediation":[],"revision":"05146edf2dff213c92b42a54a20ad1579c9ae860d576fb6f65f16d45e1070221","sources":[{"modifiedAt":1793772024533,"name":"CNA: WPScan","retrievedAt":1793776117425,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106649"}],"ssvc":null,"status":"published","title":"Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action","updatedAt":1793776117425}