Kirki 6.0.0 – 6.3.0 – Author+ Stored XSS via Unsanitized SVG Upload | CVE 2026-84223

Description

The plugin does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

Proof of Concept

The PoC will be displayed on October 02, 2026, to give users the time to update.

Affects Plugins

kirki

Fixed in 6.3.1

References

CVE

CVE-2026-84223

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Mohammed Abd Alrahman

Submitter

Mohammed Abd Alrahman

Submitter website

https://mohmadev.com/

Verified

Yes

WPVDB ID

02ed6d31-84f3-4723-8b49-ddb00c7db7d3

Timeline

Publicly Published

2026-09-18 (about 1 day ago)

Added

2026-09-18 (about 10 hours ago)

Last Updated

2026-09-18 (about 10 hours ago)

Other

Published

Title

Published

2025-04-14

Title

Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates < 1.6.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag'

Published

2025-02-19

Title

Content Blocks (Custom Post Widget) < 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter

Published

2023-10-17

Title

Fotomoto <= 1.2.8 - Reflected XSS

Published

2026-08-31

Title

WP Recipe Maker Premium < 10.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode

Published

2012-05-10

Title

User Photo < 0.9.5.2 - XSS