Stored Cross-Site Scripting in Kirki WordPress Plugin

The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. Identified as CVE-2026-17037, this flaw exists due to insufficient input sanitization and output escaping within the 'comment' parameter. The vulnerability allows unauthenticated remote attackers to inject malicious web scripts into the site's database. When a site administrator or other users navigate to the affected page, the injected JavaScript executes within their browser session. This could be leveraged to perform actions on behalf of the user, steal session cookies, or redirect users to malicious domains. The vulnerability affects all plugin versions up to and including 6.2.0. Organizations using this plugin should prioritize updating to a version that implements proper input validation and output encoding to mitigate the risk of script injection.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users' sessions. This can lead to account takeovers, unauthorized administrative actions, or the delivery of secondary payloads to visitors. As a common page-building component, the vulnerability affects a wide range of WordPress-based web properties, increasing the risk of widespread site compromise and secondary victim targeting.

Recommendation

Prioritize the immediate update of the Kirki plugin to the latest available version that patches the input sanitization flaw identified in CVE-2026-17037. If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to inspect and block POST requests containing suspicious script tags or JavaScript event handlers in the 'comment' parameter.