Kirki CVE-2026-66629

No authentication is required to craft or deliver the exploit (PR:N per CVSS vector). The victim must actively interact with a malicious URL or page containing the XSS payload (UI:R) - passive server-side exploitation without user action is not possible. Exploitation is most impactful when the victim is an authenticated WordPress user with elevated privileges (administrator or editor), as the scope change (S:C) enables the injected script to act within the victim's authenticated session context. The Kirki plugin must be installed and active on the target WordPress instance running a version at or below 6.2.3. No non-default configuration or special feature flag is indicated as a prerequisite - the vulnerability appears to exist in a standard deployment of the affected plugin versions.

The CVSS 7.1 score reflects a meaningful but not critical rating: network-accessible (AV:N), low-complexity (AC:L), no authentication required (PR:N), but dependent on user interaction (UI:R). The scope change (S:C) elevates the score past a pure reflected-XSS baseline by acknowledging cross-context browser impact. Real-world risk is moderate-to-significant for sites with authenticated admin or editor users: an attacker who can deliver a crafted link to a logged-in WordPress administrator can escalate from an anonymous web request to a full WordPress admin session takeover. No EPSS data was provided in the intelligence feed, and the vulnerability is absent from CISA KEV, indicating no confirmed mass exploitation. The Patchstack report is the sole confirmed intelligence source. Key limiting factor is UI:R - passive, unattended servers cannot be exploited without a victim interaction step. The combination of PR:N and S:C, however, makes targeted phishing campaigns against site administrators a realistic threat scenario.

An attacker identifies a WordPress site running Kirki 6.2.3 or earlier, then crafts a malicious URL containing an XSS payload targeting the vulnerable Kirki input parameter. The attacker sends this URL to a logged-in WordPress administrator via email or another channel; when the administrator opens the link, the injected JavaScript executes in their browser, exfiltrates their session cookie or WordPress nonce to an attacker-controlled server, and grants the attacker full admin-level access to the WordPress site. No public exploit code has been confirmed, but the low complexity and zero authentication requirement make independent exploit development straightforward for a motivated attacker.