Kirki < 6.3.2 - Subscriber+ Arbitrary Shortcode Execution via 'display_name'

Description

The plugin is vulnerable to arbitrary shortcode execution due to substituting a user's display_name into the composed page markup unfiltered and then running the whole result through do_shortcode() in TheFrontend::replace_content(). Because display_name is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection such as a team or member-directory page, the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the display_name user field.