CVE-2026-84223
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
| Vendor | unknown |
| Product | kirki |
| Published | Sep 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown kirki
Be the first to know when new unknown vulnerabilities affecting unknown kirki are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Kirki
6.0.0 < 6.3.1
References
Credits
Mohammed Abd Alrahman WPScan