CVE-2026-17037
HighCVSS 7.2Summary
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
An attacker can execute malicious JavaScript in a victim's browser, leading to session theft, redirects, or content modification. This poses a threat to site users and can lead to account takeover.
Recommendation
Update the Kirki plugin to a version containing the fix. Check the site for injected scripts and consider implementing security headers (CSP).
Other vulnerabilities in Kirki WordPress plugin
See all- CVE-2026-84222Medium
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
- CVE-2026-84219High
The Kirki WordPress plugin before 6.3.0 does not properly handle all HTML entities when rendering, allowing unauthenticated users to store JavaScript in a comment that executes in the session of anyone viewing the page, including an administrator, and on every page when the header or footer is built to show comments.
Original NVD description (English source)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.