CVE-2026-54002

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4

Description Kirby sites and plugins that process untrusted input using the writer or list fields, or specific sanitization methods, are subject to stored cross-site scripting (XSS). XSS is a vulnerability that allows the execution of JavaScript code within the site frontend or the Panel session of users. In a stored XSS attack, the malicious payload is saved into the content data, potentially allowing a lower-privileged authenticated user to execute scripts in the context of higher-privileged users, such as administrators.

The issue occurs because the Dom::sanitize() function fails to sanitize nodes that have been unwrapped from their parent node. When malicious markup is injected as children of an unknown HTML or XML tag, these child nodes are copied into the resulting document without being correctly sanitized. This affects the following components and methods:

Recommendations Update Kirby to version 4.9.4 or later. Update Kirby to version 5.4.4 or later. Review existing content in writer and list fields or re-sanitize all content of affected fields to remove any malicious markup stored prior to the patch.