EUVD-2026-43376Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Stored XSS in a Customizer framework realistically needs a low-privilege account to write the option (PR:L), still needs a victim to view it (UI:R), and crosses component scope (S:C).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.
AnalysisAI
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to first store a malicious value into a Kirki-managed field/option and then requires a victim to load the page or admin screen that renders it (UI:R - user interaction is mandatory, which limits opportunistic mass exploitation). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Patchstack-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes network-reachable, low-complexity exploitation requiring victim interaction, with limited confidentiality, integrity, and availability impact and a scope change - consistent with typical stored XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An actor with the ability to write a Kirki-backed option (for example a lower-privileged user in a multi-author or agency-managed WordPress site) saves a field value containing a script payload; when an administrator or another user later opens the page or Customizer view that renders the value, the script executes in their authenticated session and can perform actions such as session theft or admin-context requests. Network-reachable and low-complexity per CVSS, but requiring that victim to view the tainted content (UI:R). … |
| Remediation | No vendor-released patch version is identified at time of analysis - the input names only the vulnerable ceiling (<= 6.0.11) and no fixed release, so upgrade to the next Kirki release above 6.0.11 once the maintainer publishes it and confirm the fix against the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-11-cross-site-scripting-xss-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Themeum Kirki version 6.0.11 or earlier and audit which customization fields accept user input or third-party content, then communicate findings to stakeholders. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attack
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today