EUVD-2026-63206
GHSA-7grj-4mf9-j4px
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Editor role (PR:H) and victim page-view for XSS (UI:R) are required; RCE achieves full C/I/A impact on the vulnerable system with no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
AnalysisAI
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows users holding the Editor role to place executable and web-accessible files on the server, enabling Stored XSS against any visitor and Remote Code Execution on permissive server configurations. A publicly available proof-of-concept exists per WPScan, elevating practical risk beyond the CVSS 6.8 score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress user account with at minimum the Editor role - anonymous or Subscriber/Contributor-level accounts cannot trigger the vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.8 score with vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H correctly reflects the high-privilege prerequisite (Editor role) and user-interaction requirement for the Stored XSS path, which collectively suppress the score from what the C:H/I:H/A:H impact metrics would otherwise imply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a compromised or legitimately held WordPress Editor account crafts a ZIP archive containing a PHP webshell with a benign-looking filename. The archive is uploaded through the Kirki plugin's customizer interface; the plugin extracts the contents without validating file extensions or removing the PHP file, leaving the webshell in a web-accessible upload subdirectory. … |
| Remediation | Update the Kirki WordPress plugin to version 6.2.3 or later, which resolves this vulnerability per the WPScan advisory (https://wpscan.com/vulnerability/ba981818-f4a0-444a-bf6a-e4caacc9d1aa/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attack
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today