WordPress Plugin Vulnerabilities

Kirki < 6.2.1 - Contributor+ Stored XSS via post_meta Shortcode

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
kirki
Fixed in 6.2.1

References

CVE
CVE-2026-16974
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9fe6b4-8696-45eb-bdb8-764dea7cce88

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Navapon Premkasem (71C4) (71C4)
Verified
No
WPVDB ID
bce24b6e-0ec6-407c-baa3-b8b8e0ab3f76

Timeline

Publicly Published
2026-08-10 (about 14 days ago)
Added
2026-08-10 (about 13 days ago)
Last Updated
2026-08-10 (about 13 days ago)

Other

Published
Title
Published
2024-04-18
Title
ElementsKit Pro < 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit_btn_id'
Published
2024-12-02
Title
Themesflat Addons For Elementor < 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-20
Title
Yandex Site search pinger <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-05-02
Title
Button contact VR < 4.7.7 - Admin+ Stored XSS
Published
2025-04-24
Title
RRSSB <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting