Description

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-11T10:16:51.330Z",
  "pubdate": "2026-09-11T10:16:51.330Z",
  "executiveSummary": "The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains a critical security flaw manifesting as a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability exists due to inadequate sanitization and output escaping of the 'comment' parameter.\nThe impact of this flaw is significant, as it allows unauthenticated remote attackers to inject arbitrary JavaScript payloads into pages managed by the plugin. When a victim—potentially an administrator or an authenticated user—views the compromised page, the malicious script executes within the context of their session.\nThe vulnerability affects all versions up to and including 6.2.0. Successful exploitation does not require prior authentication, significantly lowering the barrier for entry. The risk implications include potential session hijacking, unauthorized administrative actions, sensitive data exfiltration, and the forced redirection of users to malicious external sites. Because the injected code is stored persistently within the database, the payload remains active until manually removed, creating a persistent threat vector for all site visitors or administrative staff accessing the affected content.",
  "technicalDetails": "The vulnerability resides within the input handling logic for the 'comment' parameter in the Kirki plugin. The root cause is identified as a failure to implement robust input sanitization and secure output escaping mechanisms before rendering user-supplied data back to the Document Object Model (DOM).\nIn a typical attack flow, an unauthenticated actor sends a crafted HTTP request containing malicious JavaScript payloads embedded within the 'comment' parameter. Because the application fails to perform proper context-aware validation, this malicious string is stored directly into the WordPress database.\nOnce stored, the payload resides within the application's backend. When a legitimate user—specifically one with sufficient privileges or a standard visitor—navigates to the affected page, the plugin retrieves the stored 'comment' content and injects it into the HTML structure of the rendered page without sufficient encoding. This causes the victim's web browser to parse the injected string as executable JavaScript rather than plain text.\nThe scope of this vulnerability includes versions up to and including 6.2.0. Exploitation occurs entirely over the network, as the application fails to enforce authentication or authorization checks on the input fields affected by this flaw. There are no specific privileges required for an attacker to submit the payload, making it an unauthenticated vector.\nPayload behavior is limited only by the attacker's intent and browser-based security constraints. Typical post-exploitation activities include the manipulation of the document object to steal session cookies (document.cookie), the programmatic triggering of unauthorized administrative requests (CSRF via XSS), the modification of page content to facilitate phishing, or the redirection of traffic to malicious infrastructure. Because the script executes in the victim's browser session, it bypasses network-level defenses such as firewalls that do not perform deep payload inspection for XSS vectors. The persistence of the stored payload ensures that the attack is not ephemeral; it will trigger repeatedly for every user who loads the compromised page until the record is purged from the database or the vulnerable code is patched."
}