CVE-2026-74992
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
| Vendor | unknown |
| Product | kirki |
| Published | Aug 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown kirki
Be the first to know when new unknown vulnerabilities affecting unknown kirki are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Kirki
0 < 6.2.3
References
Credits
Mohammed Abd Alrahman WPScan