Kirki Page Builder CVE-2026-102173

Three concrete preconditions must all hold: (1) WordPress 'anyone can register' (public user registration) must be enabled so an unauthenticated attacker can create an account and populate user-meta; (2) a published page must carry a kirki-register element, which prints the required element nonce into public markup; and (3) a Kirki users-collection image element must be bound to one of the nine registration meta fields, which is then concatenated into an <img src="…"> attribute without escaping. Limiting factors: the bug is unreachable when registration is closed or when no page exposes the kirki-register element/bound image field, and execution only occurs when a user actually views the rendering page - so default installations without open registration are not exploitable.

Signals are consistent but moderate. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2 High) indicates a network-reachable, low-complexity, unauthenticated stored XSS with a scope change (script executes in other users' browser context), which is the realistic ceiling for this bug class. However, real-world exploitability is gated by three non-default preconditions stated in the description: public user registration must be enabled, a page must publish a kirki-register element (which exposes the required element nonce), and an image element must be bound to one of the nine registration meta fields. These conditions meaningfully lower effective risk versus the raw 7.2. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the intelligence, so this is not demonstrably under active exploitation - it reads as a credible but not yet weaponized issue. Net: a genuine stored-XSS vulnerability worth patching promptly on affected sites that allow open registration, but a lower operational priority than a default-config unauthenticated RCE. The PR:N rating reflects attacker self-registration rather than pre-existing privilege; defenders should note the vulnerability cannot be reached at all when registration is closed.

An attacker self-registers on a WordPress site running Kirki ≤6.3.1 that has open registration and a published page containing a kirki-register element whose image element is bound to a registration meta field. During or after registration the attacker places a malicious payload into that meta value, which is concatenated unescaped into an <img src="…"> attribute; the script then fires in the browser of any visitor or administrator who views the page rendering the Kirki users collection. No public exploit code was identified in the provided data, but the attack is low-complexity once the required configuration is present.