Themeum Kirki CVE-2026-42694

Exploitation requires an authenticated low-privilege account (PR:L) on a WordPress site running the Kirki framework at version 6.4.0 or earlier; the attacker must be able to reach an affected Kirki input that improperly neutralizes script-related HTML tags. The exact field, setting, or admin screen that serves as the injection point is not described in the available sources. Realistic exploitation is limited by the authentication requirement (no anonymous access) and by the stored nature of basic XSS - a second user, typically an administrator, must subsequently view the page hosting the payload for the script to execute; impact is confined to low confidentiality with no integrity or availability effect per the supplied vector.

This is a medium-severity, authenticated XSS/code-injection issue, not a high-urgency emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) shows network reachability with low attack complexity but requires low-level privileges (PR:L), meaning a valid authenticated account is needed, and impact is limited to low confidentiality only (I:N/A:N). The vuln.today decision label is 'this_month' - a routine patch cadence, not act_now or emergency. Key exploitation-probability signals are absent: no EPSS score was supplied, there is no CISA KEV listing, and no proof-of-concept or exploit code is referenced (the only reference is a Patchstack vulnerability-database entry, not working exploit code). Taken together, the signals are internally consistent - a moderate, privilege-gated web flaw with no evidence of active exploitation - so this reads as a standard scheduled-patch item rather than a high-CVSS/low-real-risk anomaly or an urgent threat. Note the limitation: because EPSS and KEV data were not provided, the exploitation-likelihood dimension is unmeasured rather than confirmed low.

An attacker with a low-privilege authenticated WordPress account on a site running the Kirki framework submits input containing script-related HTML tags into an affected Kirki field, which is stored without proper neutralization. When an administrator or other user later views the page containing the payload, the injected script executes in their browser session. No public exploit code is identified in the available sources.