PT-2026-95921 · WordPress · Kirki
CVE-2026-84223
·
Published
2026-09-20
·
Updated
2026-09-20
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Kirki versions 6.0.0 through 6.3.0
Description
Insufficient sanitization of uploaded SVG files allows users with author-level access and above to upload files containing JavaScript. This leads to a stored Cross-Site Scripting (XSS) condition, where the malicious script is served from the site's own origin and executes in the session of any user who opens the file.
Recommendations
Update Kirki to version 6.3.1 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kirki