CVE-2026-84223 — Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload

CVE-2026-84223

Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload PUBLISHED

Description (CNA)

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

Affected (CNA)

Vendor / product	Versions
Unknown / Kirki	affected 6.0.0 before 6.3.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/02ed6d31-84f3-4723-8b49-ddb00c7db7d3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.