What is the CVSS score of CVE-2026-57725?

CVE-2026-57725 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Kirki are affected by CVE-2026-57725?

Themeum Kirki, a critical WordPress customizer plugin affecting thousands of organizations, contains a stored cross-site scripting flaw allowing attackers to inject persistent malicious code that…

How to fix or mitigate CVE-2026-57725?

Within 24 hours, identify all WordPress installations running Themeum Kirki version 6.0.11 or earlier and audit which customization fields accept user input or third-party content, then communicate findings to stakeholders. Within 7 days, restrict customizer access to vetted administrators only, implement strict Content Security Policy headers, deploy input validation and output encoding on all customizer settings, and activate WordPress security plugins with XSS filtering capabilities. Within 30 days, monitor Themeum's security advisories for patched versions, conduct forensic analysis of customizer settings for evidence of prior exploitation, evaluate migration to alternative customizer solutions, and perform comprehensive security scanning of all affected WordPress instances.

Kirki CVE-2026-57725

EUVD-2026-43376 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Kirki Themeum

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Stored XSS in a Customizer framework realistically needs a low-privilege account to write the option (PR:L), still needs a victim to view it (UI:R), and crosses component scope (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:45 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.

AnalysisAI

Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Kirki (cpe:2.3:a:themeum:kirki) is a widely used toolkit/framework that extends the WordPress Customizer with additional control types, fields, and styling options, and is bundled or depended upon by many commercial and free themes. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is written into generated HTML without adequate output encoding or sanitization. In a stored variant, the tainted value is saved server-side (e.g. a customizer/theme option or field value) and later reflected into a page or admin view, so the browser interprets attacker markup as executable script rather than data.

RemediationAI

No vendor-released patch version is identified at time of analysis - the input names only the vulnerable ceiling (<= 6.0.11) and no fixed release, so upgrade to the next Kirki release above 6.0.11 once the maintainer publishes it and confirm the fix against the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-11-cross-site-scripting-xss-vulnerability. Until a fixed version is confirmed, restrict who can edit Customizer/theme options carrying Kirki fields to trusted administrators only, review existing stored option values for injected markup, and consider a WAF or virtual-patching rule (Patchstack offers this) to filter script payloads in the affected fields; the trade-off is that tightening editor capabilities may block legitimate low-privilege customization workflows. If Kirki is only a bundled dependency and unused, removing it eliminates the exposure at the cost of theme features that rely on it.