Kirki CVE-2026-57725

Exploitation requires the attacker to first store a malicious value into a Kirki-managed field/option and then requires a victim to load the page or admin screen that renders it (UI:R - user interaction is mandatory, which limits opportunistic mass exploitation). The affected surface exists only where the Themeum Kirki framework is installed and active (bundled with the theme or as a standalone plugin) at version 6.0.11 or earlier. The CVSS vector states PR:N, but the description does not identify the injection endpoint; if storing the payload in fact needs an authenticated Customizer/option-write capability, the practical prerequisite is a valid low-privilege account - verify the exact injection path with Patchstack before assuming unauthenticated write is possible.

The Patchstack-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes network-reachable, low-complexity exploitation requiring victim interaction, with limited confidentiality, integrity, and availability impact and a scope change - consistent with typical stored XSS. No EPSS score, SSVC decision, POC, or KEV signal was provided, so exploitation probability cannot be quantified from the input and should be treated as unknown rather than high. One point of tension: the vector lists PR:N (no privileges), yet stored XSS in a Customizer framework normally requires some authenticated capability to write the option that carries the payload; the source description does not state the injection path, so the true privilege requirement is unconfirmed and PR:N may overstate reachability. Net assessment: a genuine but moderate-severity issue - routine-patch priority for sites running Kirki, not an emergency unless corroborating exploitation data emerges.

An actor with the ability to write a Kirki-backed option (for example a lower-privileged user in a multi-author or agency-managed WordPress site) saves a field value containing a script payload; when an administrator or another user later opens the page or Customizer view that renders the value, the script executes in their authenticated session and can perform actions such as session theft or admin-context requests. Network-reachable and low-complexity per CVSS, but requiring that victim to view the tainted content (UI:R). No public POC is referenced in the available data.