Executive brief
The Kirki WordPress plugin allows authors and higher-privileged users to upload SVG files without sanitizing their content, enabling malicious JavaScript injection. An attacker can upload an SVG containing JavaScript code that executes in the browsers of anyone viewing the file, leading to session hijacking, credential theft, or account takeover of affected site visitors.
Technical details
The plugin fails to sanitize SVG file uploads while enabling them site-wide, allowing an author-level user to inject arbitrary JavaScript within SVG files. The vulnerability is stored XSS (CWE-79): the malicious payload persists on the server and executes in the context of the victim's session when they access the file from the same origin. A fix is available in version 6.3.1.
Affected products
- Kirki Contributors Kirki 6.0.0 through 6.3.0
Timeline
- 2026-09-18: disclosed
- 2026-09-20: patched: Fixed in version 6.3.1