Description

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:16:57.700Z",
  "pubdate": "2026-08-18T15:16:57.700Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Kirki framework affecting versions <= 6.2.3. This security flaw allows remote, unauthenticated threat actors to inject malicious client-side scripts, typically JavaScript, into web pages rendered to other users visiting the vulnerable WordPress site.\nThe primary impact of this vulnerability includes potential session hijacking, credential theft, unauthorized actions performed on behalf of legitimate users, and the defacement or redirection of the affected web application. Because the flaw is unauthenticated, attackers do not require valid credentials or prior access to the system to initiate an attack vector.\nThe risk implication is critical for organizations utilizing vulnerable versions of Kirki, as successful exploitation undermines the integrity of the application's user interface and exposes users to browser-based compromise. Exploitation requirements are minimal, typically requiring only that a victim interacts with a specially crafted URL or input vector designed to trigger the reflected or stored script execution within their active browser session.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and inadequate output encoding within the Kirki framework for versions <= 6.2.3. Web applications utilizing this affected component fail to properly validate and neutralize user-supplied parameters before reflecting them back in the Hypertext Markup Language (HTML) response or storing them for later rendering.\nThe vulnerability manifests as a Cross-Site Scripting (XSS) vector that is accessible without authentication. Network exposure is external, meaning any remote attacker with access to the web interface can interact with the vulnerable endpoint. The affected component processes HTTP requests containing malicious payloads without enforcing privilege or authentication checks.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious payload containing executable JavaScript encapsulated within HTML tags or event handlers. Second, the attacker induces a victim to load a request containing this payload targeting the vulnerable Kirki component. Third, the application processes the input and reflects or outputs the payload directly into the Document Object Model (DOM) of the victim's browser without proper contextual encoding.\nFinally, the victim's browser interprets the injected payload as legitimate application script and executes it within the security context of the victim's session. Post-exploitation impact depends on the privileges of the user interacting with the compromised page, potentially granting the attacker access to session tokens, cookies, or the ability to execute unauthorized administrative actions if an authenticated administrator falls victim to the exploit."
}