Description

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-20T07:16:50.200Z",
  "pubdate": "2026-09-20T07:16:50.200Z",
  "executiveSummary": "The Kirki WordPress plugin, in versions prior to 6.3.1, contains a critical Stored Cross-Site Scripting (XSS) vulnerability stemming from improper input validation of SVG file uploads. By failing to sanitize the contents of uploaded SVG files, the plugin inadvertently permits the injection of arbitrary malicious JavaScript payloads.\nThis vulnerability is reachable by authenticated users with author-level privileges or higher. Upon a successful upload, the malicious SVG file is stored on the server and served from the application's own origin. When a victim, such as an administrator, accesses the file, the embedded JavaScript executes within their active session context.\nThe implications are severe, as an attacker can leverage this execution to perform unauthorized actions on behalf of the victim, potentially leading to full site compromise, privilege escalation, or data exfiltration. Given that the payload originates from the trusted site domain, security controls like Same-Origin Policy (SOP) do not prevent the execution, making this a significant security risk for WordPress installations utilizing the affected versions of the Kirki plugin.",
  "technicalDetails": "The vulnerability resides in the file handling logic of the Kirki WordPress plugin, which modifies the platform's standard file upload behavior to enable site-wide SVG support without implementing sufficient sanitization mechanisms. SVG files are XML-based, which allows for the embedding of ECMAScript (JavaScript) within various elements such as <script> tags or through event handlers like 'onload' within the XML structure.\nRoot Cause Analysis: The plugin fails to perform server-side content inspection or XML sanitization on the uploaded SVG files before persisting them to the server's storage directory. By not stripping executable code from the XML document, the plugin treats these files as trusted media uploads.\nExploitation Flow: An attacker with at least author-level privileges initiates the attack by crafting a malicious SVG file containing a JavaScript payload. This payload might be designed to perform actions like creating new administrative accounts, modifying plugin settings, or stealing session cookies via document.cookie access. The attacker uploads this file through the vulnerable Kirki interface. Because the plugin grants the file site-wide accessibility, it is stored in a publicly accessible path.\nPayload Execution: Once the file is hosted on the server, the attacker induces a target user (e.g., a site administrator) to view the SVG file. Because the file is served from the same origin as the WordPress installation, the browser executes the embedded JavaScript in the context of that session. The script operates with the permissions of the victim, allowing the attacker to bypass administrative controls.\nVulnerable Components and Versions: This issue affects all versions of the Kirki WordPress plugin prior to 6.3.1. The flaw exists due to the lack of secondary validation or the use of established security libraries (such as those used by the WordPress core media upload system) to inspect XML content for script injection vectors. The vulnerability is entirely server-side in its lack of filtering, though it requires the authenticated presence of an attacker capable of triggering the upload process."
}