Kirki WordPress Plugin CVE-2026-84219

The attack requires that: (1) the target WordPress site has the Kirki plugin installed and active at a version below 6.3.0; (2) unauthenticated or low-privilege user commenting is enabled on at least one post or page (default WordPress behavior); (3) a victim - ideally an administrator - views a page where the malicious comment is rendered, either directly or through a Kirki-managed header/footer component that displays recent comments. No special server configuration or non-default Kirki settings are required beyond default WordPress commenting being enabled. Exploitation is limited by the need for victim interaction (UI:R): the stored payload does not execute until a user loads an affected page. If comment moderation requires approval before display, an attacker must bypass or wait for moderation, though sites with auto-approval have no such delay.

The provided CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.5, but AC:H appears overstated for a stored XSS: once a working payload is crafted (one-time attacker effort), delivery to victims is passive and reliable, which is characteristic of AC:L. Similarly S:U may understate risk given that an admin executing the payload can modify WordPress core settings, install plugins, or exfiltrate credentials - constituting a scope change to the broader WordPress installation. The real-world risk is elevated because: (1) exploitation requires no authentication on the injection side; (2) a public PoC (WPScan) exists, lowering attacker skill requirements; (3) site-wide impact is possible via header/footer rendering, meaning a single stored payload can fire on every page load across the entire site for every visitor. The EPSS and KEV signals are not provided in this data, but the WPScan publication and PoC availability make opportunistic exploitation credible at scale against unpatched WordPress installations.

An unauthenticated attacker posts a comment to any publicly accessible WordPress page on a site running Kirki below 6.3.0, embedding a JavaScript payload encoded using an alternate HTML entity representation (e.g., hexadecimal numeric entities) that bypasses Kirki's incomplete sanitization. The comment is approved and rendered. When an administrator visits any page displaying the comment - or any page whose Kirki-managed header/footer includes comment output - the payload executes silently in the admin's browser session, enabling cookie theft, credential capture, or remote plugin installation via the WordPress REST API. A public PoC from WPScan confirms this attack path is documented.