Kirki Page Builder CVE-2026-14572

Exploitation requires an authenticated account that has been explicitly granted the kirki_content_access capability by an administrator - this is a non-default, elevated content permission, not a standard subscriber/author role, and the attacker must use the plugin's Page Builder Text Content input field to store the payload. The stored script fires only when a user subsequently accesses the injected page (UI:N for the attacker, but a victim page-view is needed for impact). Limiting factors: the capability grant by an admin is the primary barrier, affected versions are 6.2.0 and earlier only, and upgrading to 6.2.1 removes the flaw.

This is a moderate, not high-urgency, issue. The CVSS 6.4 (MEDIUM) rating with vector AV:N/AC:L/PR:L/UI:N/S:C reflects remote network reach and low attack complexity, but the real gating factor is PR:L combined with the description's explicit requirement for the non-default 'kirki_content_access' capability, which must be deliberately granted by an administrator. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - per precision rules this is 'no public exploit identified at time of analysis.' The S:C (scope change) and C:L/I:L impacts are consistent with stored XSS executing in the browser of any user who later views the injected page. Net: a legitimately-scoped-low vulnerability whose practical risk is bounded by the attacker first needing an admin to grant them a specialized content capability - closer to a privileged-insider/content-contributor abuse case than an internet-wide mass-exploitation threat. A vendor patch exists (Wordfence/Trac changeset to version 6.2.1), which should drive routine rather than emergency remediation.

An authenticated user who has been granted the kirki_content_access capability by an administrator (e.g., a content contributor) enters a malicious script payload into Page Builder text content instead of benign copy. Because input is insufficiently sanitized and output is not escaped, the script is stored and then executes in the browser of every visitor or administrator who subsequently opens the affected page. No POC was provided in the input, and because UI:N the victim only needs to view the page normally for the payload to fire.