Is CVE-2026-16974 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16974 being exploited in the wild.

How severe is CVE-2026-16974?

Medium severity, with a CVSS score of 6.4, published 11 August 2026.

Which products and versions are affected?

Firjan Kirki up to and including 6.2.0.

Is there a fix for CVE-2026-16974?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16974 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16974?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16974: Kirki Freeform Page Builder Stored XSS in post_meta Shortcode

CVE-2026-16974 · Severity: medium · CVSS 6.4 · Published 2026-08-11

The Kirki plugin is a page builder and customizer tool used by WordPress administrators to design website pages. A flaw in how it handles user-supplied content allows attackers with contributor-level access or higher to inject malicious scripts into pages. When site visitors view these compromised pages, the injected scripts execute in their browsers, potentially stealing credentials, session tokens, or performing actions on their behalf.

Quick answers

Is CVE-2026-16974 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16974 being exploited in the wild.
How severe is CVE-2026-16974?: Medium severity, with a CVSS score of 6.4, published 11 August 2026.
Which products and versions are affected?: Firjan Kirki up to and including 6.2.0.
Is there a fix for CVE-2026-16974?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16974 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16974?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the post_meta Shortcode handler affecting Kirki versions up to 6.2.0. The root cause is insufficient input sanitization and output escaping of user-supplied data. An authenticated attacker with Contributor-level permissions or above can inject arbitrary JavaScript into page metadata via the post_meta Shortcode parameter. The injected script persists in the database and executes in the browsers of all users who access the affected page. No user interaction beyond normal site browsing is required for exploitation; the XSS payload fires automatically when the page is viewed.

Affected products

Firjan Kirki up to and including 6.2.0

Timeline

2026-08-11: disclosed
2026-08-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.