EUVD-2026-55934
GHSA-g4jx-9qx8-f3f9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R applied because a victim must actively load the injected page to trigger execution; all other metrics match contributor-authenticated stored XSS with cross-boundary scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the post_meta shortcode handler of the Kirki plugin (CPE: cpe:2.3:a:themeum:kirki_-_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:*), developed by Themeum. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) identifies the root cause as insufficient sanitization of shortcode attributes combined with inadequate output escaping before dynamic content is rendered into HTML responses. WordPress shortcodes are bracket-enclosed processing tags embedded in post content; the post_meta shortcode retrieves and outputs post metadata values, and without proper escaping these values can carry injected JavaScript payloads directly into the DOM of any page that renders the shortcode.
RemediationAI
Update the Kirki plugin to the version released after 6.2.0 that incorporates the fix committed in WordPress plugin repository changeset 3636487 (https://plugins.trac.wordpress.org/changeset/3636487); the exact patched release version number is not independently confirmed in currently available data, so verify the installed version against the plugin's changelog after updating via the WordPress dashboard or WP-CLI (wp plugin update kirki). As a compensating control prior to patching, restrict the Contributor role from publishing posts directly - note that this may disrupt editorial workflows requiring contributor submissions - or audit existing posts created by contributor accounts for unexpected shortcode payloads using a query against wp_posts content. Sites running a Web Application Firewall with stored XSS detection rules can add an additional layer of detection. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9fe6b4-8696-45eb-bdb8-764dea7cce88 for updated remediation guidance as more version detail becomes available.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today