Executive brief
The Kirki plugin is a WordPress page builder tool that allows website administrators to customize and build pages. A vulnerability in versions up to 6.2.0 allows unauthenticated attackers to inject malicious JavaScript code that persists in the database and executes for all visitors viewing affected pages, potentially compromising visitor data or redirecting them to malicious sites.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the 'comment' parameter that affects Kirki versions up to and including 6.2.0. The plugin fails to properly sanitize input and escape output when handling the comment parameter, allowing unauthenticated attackers to inject arbitrary web scripts. Since the malicious payload is stored in the database, it will execute in the context of any user who accesses the affected page, making this a high-impact vulnerability. The attack requires no authentication and is network-accessible through normal plugin functionality.
Affected products
- Kirki Freeform Page Builder up to 6.2.0
Timeline
- 2026-09-11: disclosed