EUVD-2026-83668
GHSA-96mm-r72j-4pv6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Author-level account
-
DeliveryUpload SVG with embedded JavaScript
-
ExploitLure admin to open file
-
ExecutionScript runs in admin session from site origin
-
PersistHijack session / forge admin actions
-
ImpactSite takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress user with Author-level role or higher on a site running Kirki 6.0.0-6.3.0. The specific trigger is Kirki making SVG files uploadable site-wide without sanitization, so the account must be able to upload media. Exploitation additionally requires user interaction (UI:R): a victim - ideally an administrator - must open/view the uploaded SVG for the embedded JavaScript to execute from the site's origin. Limiting factors: not unauthenticated (needs at least Author), depends on the victim actually opening the file, and is fully mitigated by upgrading to 6.3.1. |
| Impact | This is a genuine but conditionally-gated stored-XSS priority rather than a mass-exploitation emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8) contains an internal tension worth flagging: it assigns PR:H yet the description explicitly says 'author-level access and above', and author is a mid-tier WordPress role that WPScan conventionally maps to PR:L - so the privilege bar is lower than the vector implies, which if anything raises real risk. Exploitation requires an authenticated Author+ account plus UI:R (a victim must open the malicious SVG), so it is not drive-by unauthenticated. POC is publicly available (WPScan) but the vulnerability is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active exploitation - POC availability and active exploitation are distinct signals. Net: the high C/I/A impact reflects that JavaScript running from the site's own origin in an admin's session can escalate to full site takeover, making this a real patch-now item for multi-author sites, but the authenticated + user-interaction prerequisites keep it below wormable/critical-urgency tier. A vendor patch (6.3.1) is confirmed available, which is the decisive mitigation signal. |
| Exploit ScenarioDerived | An attacker who holds or phishes an Author-level WordPress account uploads a malicious .svg file (which Kirki makes uploadable site-wide without sanitization) containing embedded JavaScript. When an administrator or other user opens or previews that file, the script executes from the site's own origin in their authenticated session, allowing session/cookie theft, admin action forgery, or account/site takeover. A public proof-of-concept for this vector exists via WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Stored cross-site scripting in the Kirki WordPress plugin affects versions 6.0.0 through 6.3.0, which allow SVG files to be uploaded site-wide without sanitization; an authenticated user with Author-level access or higher can upload an SVG carrying embedded JavaScript that is then served from the site's own origin. When a victim - ideally an administrator - opens or views that file, the script runs in their session, giving the attacker same-origin script execution with high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), and publicly available exploit code exists. This is a genuine but conditionally-gated stored-XSS priority rather than a mass-exploitation emergency: it requires an authenticated Author-level account and a victim interacting with the uploaded file, and it is fully mitigated by upgrading to 6.3.1.
RemediationAI
Vendor-released patch: 6.3.1 - upgrade the Kirki plugin to 6.3.1 or later, which restores sanitization of uploaded SVG files and is the only complete fix (advisory: https://wpscan.com/vulnerability/02ed6d31-84f3-4723-8b49-ddb00c7db7d3/). Where immediate patching is not possible, apply layered compensating controls and accept their trade-offs: block SVG uploads entirely by removing the svg/svgz MIME types from the allowed list (upload_mimes filter) or by hooking the media upload path for those types, which removes the exposure but breaks any legitimate SVG use on the site; if SVG support is required, restrict it to Administrator-only and revoke unfiltered_upload/file-upload capabilities from Author and Contributor roles, which narrows the attack surface to a small, trusted account set but still leaves a single compromised admin account able to plant a payload; sanitize SVGs server-side on upload with a dedicated SVG sanitizer that strips <script>, event-handler attributes, and external references, which keeps functionality but requires careful configuration and ongoing maintenance; serve the media library's SVG files from a separate cookieless domain or force Content-Disposition: attachment plus a strict Content-Security-Policy with sandbox on the uploads path, which prevents same-origin script execution but adds infrastructure complexity and may break inline media previews; and search the existing media library for previously uploaded SVG files, review their contents, and delete any that carry script or event-handler code. Note that no CISA KEV entry is associated with this CVE, so exploitation is not confirmed as active at time of analysis, though publicly available exploit code exists and raises the likelihood of targeted use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (improper neutralization of input during web page generation), specifically a stored/persistent XSS delivered through SVG media. SVG is an XML-based graphics format that can legitimately contain <script> elements, event handler attributes such as onload, and <foreignObject> blocks, so accepting unsanitized SVG is functionally equivalent to accepting arbitrary HTML/JavaScript uploads. The Kirki plugin extends WordPress's allowed upload MIME types to include SVG site-wide, which means authors and above can place a crafted file into the media library; WordPress then serves it from the site's own domain and origin. Because the file is same-origin, the embedded script is not isolated by the browser's same-origin policy and executes in the security context of whatever user opens it, which is why the independent assessment scores scope as changed (S:C) rather than unchanged as in the submitted vector. It also explains the high C/I/A ratings: a script running on the site's origin can read rendered administrative content, act with the victim's session, and alter site data. The supplied CPE (cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:*) is an unversioned wildcard, so version scoping must come from the vendor/ENISA data, which pins the vulnerable range at 6.0.0 up to but not including 6.3.1.
Know when Kirki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is low-privilege not high (PR:L, disputing vendor PR:H); payload executes in other users'/admin sessions so scope changes (S:C); admin-session XSS enables takeover (C/I/A:H); victim must open file (UI:R).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persis
Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows
SQL injection in the Kirki WordPress plugin (versions 6.0.0 through <6.3.0) enables authenticated users with editor-leve
Unauthenticated shortcode injection in Kirki WordPress plugin (all versions before 6.2.1) allows any remote attacker to
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Kirki WordPress Customizer Framework plugin before 6.0.14 exposes registered user email addresses, comment author emails
Unauthenticated content disclosure in the Kirki WordPress plugin before 6.3.0 allows any remote attacker to retrieve the
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
Exploit-DB