WordPress Plugin Vulnerabilities

Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action

Description

The plugin does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.

Proof of Concept

Affects Plugins

Plugin icon
kali-forms
Fixed in 2.4.29

References

CVE
CVE-2026-106649

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Hackmars
Submitter
Hackmars
Verified
Yes
WPVDB ID
b8602baf-33b2-46b2-98c7-7d29a393faf3

Timeline

Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2023-04-05
Title
Stagtools < 2.3.7 - Contributor+ Stored XSS
Published
2023-04-28
Title
Photo Gallery Slideshow & Masonry Tiled Gallery < 1.0.14 - Reflected Cross-Site Scripting
Published
2025-10-11
Title
Enzy < 1.6.4 - Reflected Cross-Site Scripting
Published
2025-03-04
Title
Recently Purchased Products For Woo < 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter
Published
2025-02-04
Title
News List <= 1.0 - Reflected XSS