CVE-2026-84219
Received Received - Intake

Stored XSS in Kirki WordPress Plugin

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: WPScan

Description
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-07
AI Q&A
2026-09-06
EPSS Evaluated
2026-09-06
NVD
CVE-2026-84219
EUVD
EUVD-2026-72065

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
aristath kirki to 6.3.0 (exc)
aristath kirki 6.2.1
aristath kirki 6.2.2
aristath kirki 6.2.3
aristath kirki 6.2.4
aristath kirki 6.2.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the Kirki WordPress plugin versions 6.2.1 to 6.2.5. It occurs because the plugin does not properly decode HTML entities when rendering, allowing malicious JavaScript to be stored in comments. When users view pages with these comments, the script executes in their session, including administrators.

Detection Guidance

Check the installed version of the Kirki plugin in your WordPress admin panel. If it is between 6.2.1 and 6.2.5, the system is vulnerable. Review comments on your site for unusual JavaScript code or HTML entities that may indicate an injection attempt.

Impact Analysis

Unauthenticated attackers can inject JavaScript into comments, which runs when viewed by others. This could lead to session hijacking, theft of cookies or credentials, or unauthorized actions performed by the victim. Administrators viewing infected pages are particularly at risk, as the script could gain elevated access.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect user data from such exploits.

Mitigation Strategies

Update the Kirki plugin to version 6.3.0 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Regularly audit comments for malicious content and monitor site behavior for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart