CVE-2026-102173

HighCVSS 7.2

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

28th percentile - higher than 28% of all known CVEs

Summary

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1. This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element.

Risk Assessment

An attacker can inject malicious scripts that execute in the browser of administrators or other users, potentially leading to session theft, defacement, or other attacks.

Recommendation

Update the Kirki plugin to a version newer than 6.3.1 if available, and consider disabling public registration if not necessary.

Other vulnerabilities in Kirki – Freeform Page Builder, Website Builder & Customizer

CVE-2026-8206Critical
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress versions 6.0.0 to 6.0.6 is vulnerable to privilege escalation via account takeover. The plugin accepts an arbitrary email address when a username is used in the password reset request, allowing unauthenticated attackers to send a password reset link to their own email.

Original NVD description (English source)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS