Description

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-06T07:16:43.427Z",
  "pubdate": "2026-09-06T07:16:43.427Z",
  "executiveSummary": "The Kirki WordPress plugin, in versions prior to 6.3.0, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw stems from insufficient sanitization of HTML entities during the rendering process, which allows for the injection and execution of malicious JavaScript within the application context.\nThe vulnerability enables unauthenticated attackers to store arbitrary scripts within comments. When these comments are rendered on the front end—including in site-wide headers or footers—the payload executes within the browser session of any user viewing the page, including administrative accounts. The primary risk involves unauthorized actions performed on behalf of authenticated users, potential session hijacking, and the propagation of malicious content across the entire site architecture. Given the ease of exploitation, which does not require authentication or elevated privileges, this vulnerability poses a significant risk to the integrity and confidentiality of the WordPress installation.",
  "technicalDetails": "The vulnerability resides within the rendering logic of the Kirki plugin where HTML entities are decoded and subsequently output to the Document Object Model (DOM) without adequate filtering or contextual encoding. The root cause is an improper neutralization of input within the comment rendering component, which fails to correctly identify or sanitize certain variants of encoded HTML entities. This oversight permits an attacker to bypass standard security filters that are intended to strip or neutralize executable code.\nThe attack flow begins when an unauthenticated attacker submits a comment containing a crafted payload. This payload is stored persistently in the database by the application. Because the rendering engine fails to sanitize these specific HTML entity spellings, the malicious JavaScript is treated as valid, executable content rather than plain text when retrieved and displayed.\nExploitation occurs when a victim—such as a site administrator—visits a page where the malicious comment is displayed. The victim's browser interprets the stored payload as legitimate script tags or event handlers, triggering execution within the context of the victim's session. Since the script executes in the victim's browser, the attacker can leverage the victim's session cookies and permissions to perform unauthorized actions. These actions may include creating new administrative accounts, modifying site configuration, injecting additional malicious content, or exfiltrating sensitive data stored in the session.\nThe impact is magnified by the plugin's integration into global site elements. Because Kirki may render comments within the site header or footer, the payload is executed on every page request where these global components are loaded, maximizing the potential exposure of site administrators and other users. This architectural design flaw transforms a localized comment injection into a site-wide XSS vector. The vulnerability affects all Kirki versions prior to 6.3.0 and requires no specific privilege level to initiate the initial injection, making it highly accessible to external threat actors. There are no requirements for specialized user interaction beyond the victim viewing a page where the injected comment is rendered, thereby satisfying the conditions for a persistent, high-impact XSS attack."
}