Executive brief
The Kirki WordPress plugin is used to customize website appearance and functionality. Before version 6.3.0, it fails to properly decode certain HTML entities when rendering page comments, allowing attackers to inject malicious JavaScript code that executes in the browsers of anyone viewing affected pages—including administrators—potentially leading to account compromise and site-wide malware distribution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the HTML entity decoding logic of the Kirki plugin (CWE-79). The plugin does not validate all variations of HTML entities before rendering them, enabling unauthenticated attackers to inject malicious JavaScript through comment fields. The injected script persists in the database and executes whenever the comment is displayed to any site visitor, including administrators. Attack vectors include page comments shown in site headers, footers, or comment sections. The vulnerability is fixed in version 6.3.0.
Affected products
- Kirki Kirki 6.2.1 to 6.2.5
Timeline
- 2026-09-04: disclosed
- 2026-09-06: patched: Fixed in version 6.3.0