# CVE-2026-102173: Kirki Page Builder stored cross-site scripting in registration metadata

Source: https://junglewise.ai/threats/cve-2026-102173-the-kirki-freeform-page-builder-website-builder-customizer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-102173 · Severity: high · CVSS 7.2 · Published 2026-10-07

Kirki is a WordPress page builder and customizer plugin. Unauthenticated attackers can inject malicious scripts through user registration fields that execute when the page is viewed, potentially allowing account takeover, data theft, or malware distribution to site visitors. The attack requires user registration to be enabled and a page using Kirki's user collection display.

Technologies: [Kirki – Freeform Page Builder](https://junglewise.ai/threats/technologies/freeform-page-builder). Vendors: [Kirki](https://junglewise.ai/threats/vendors/kirki).

## Quick answers

**Is CVE-2026-102173 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102173 being exploited in the wild.

**How severe is CVE-2026-102173?** High severity, with a CVSS score of 7.2, published 7 October 2026.

**Which products and versions are affected?** Kirki – Freeform Page Builder up to and including 6.3.1.

**Is there a fix for CVE-2026-102173?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102173 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102173?** Check whether you run Kirki – Freeform Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the ExceptionalElements::image_element() method, which fails to escape user-provided registration metadata before inserting it into HTML image src attributes. An unauthenticated attacker can register a user, inject malicious JavaScript into registration meta fields, and have it execute in the browsers of any user viewing a page that displays Kirki user collections with image elements bound to those meta fields. The attack requires public user registration and Kirki registration elements to be published on the site.

## Affected products

- Kirki Kirki – Freeform Page Builder up to and including 6.3.1

## Timeline

- 2026-10-07: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php](https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php)
- [https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php](https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php)