CVE-2026-84223
Received Received - Intake

Kirki Plugin SVG File Upload XSS Vulnerability

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: WPScan

Description
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-84223
EUVD
EUVD-2026-83668

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
aristath kirki to 6.3.1 (exc)
wp-kirki kirki to 6.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kirki WordPress plugin before version 6.3.1 has a stored cross-site scripting (XSS) vulnerability. It allows users with author-level access or higher to upload SVG files containing JavaScript code without proper sanitization. When these files are accessed by others, the JavaScript executes in their session because it is served from the site's own origin.

Detection Guidance

Check if the Kirki plugin version is between 6.0.0 and 6.3.0. Look for unauthorized SVG uploads in the WordPress media library. Review server logs for suspicious file uploads or access patterns.

Impact Analysis

Attackers with author-level access could upload malicious SVG files to inject and execute arbitrary JavaScript in the browsers of other users. This could lead to session hijacking, theft of sensitive data, or defacement of the website. All users visiting the site could be affected if they access the uploaded SVG file.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if user data is compromised through this exploit.

Mitigation Strategies

Update the Kirki plugin to version 6.3.1 or later immediately. Remove any untrusted SVG files from the media library. Restrict author-level and higher user roles to prevent unauthorized uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart