CVE-2026-102173 in Kirki Plugin
Summary
by MITRE • 10/07/2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Kirki – Freeform Page Builder plugin for WordPress represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw exists across all versions up to and including 6.3.1, stemming from insufficient input validation and output encoding within the plugin's core functionality. Specifically, the issue resides in the ExceptionalElements::image_element() method, which handles the rendering of image elements associated with user metadata. The technical root cause is that this function concatenates a value retrieved directly from WordPress user meta fields into an HTML attribute without proper escaping or sanitization. This lack of encoding allows malicious scripts to be embedded within what appears to be standard profile data, turning legitimate user information into a vector for code execution when rendered in the browser context.
From an operational perspective, this vulnerability enables unauthenticated attackers to inject arbitrary web scripts that execute automatically whenever another user accesses a page containing specific Kirki elements bound to vulnerable registration metadata fields. For the attack to succeed, two primary conditions must be met: public user registration must be enabled on the WordPress site, and there must be a published page utilizing a kirki-register element. This element is critical because it prints the required nonce into the public markup, thereby allowing the frontend JavaScript to interact with the backend data structures that contain the injected payload. Once these conditions are satisfied, any visitor viewing such a page will have their browser execute the malicious script embedded in the user profile image metadata of another registered user. This effectively transforms standard user profiles into persistent attack vectors, as the stored XSS payload remains active until removed from the database or the vulnerable plugin version is updated.
The impact of this vulnerability extends beyond simple defacement or session hijacking through cookie theft. Because the script executes in the context of the victim's browser with their authentication cookies and permissions, attackers can perform actions on behalf of the user. This includes accessing sensitive site content, modifying settings, performing administrative tasks if the victim has elevated privileges, or redirecting users to phishing sites designed to steal credentials further. The stored nature of this XSS means that each page load by a new visitor triggers the attack, potentially compromising multiple victims without requiring them to interact with malicious links directly, unlike reflected XSS attacks which often require social engineering to lure users into clicking poisoned URLs.
To mitigate this risk, site administrators should immediately update the Kirki plugin to version 6.3.2 or later, where the input validation and output encoding issues have been addressed by properly escaping user-supplied data before it is inserted into HTML attributes. If updating is not immediately possible, temporary mitigations include disabling public user registration on affected sites to prevent new accounts from being created with malicious metadata, although this does not remove existing stored payloads in already registered users' profiles. Additionally, administrators should review published pages for the presence of kirki-register elements and consider removing them or restricting access until patches are applied. Implementing a Web Application Firewall (WAF) can also provide an additional layer of defense by detecting and blocking common XSS patterns in HTTP requests before they reach the application logic.
From a classification standpoint, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. The specific mechanism involves stored persistence where malicious scripts are saved on the target server and executed later by victims. In terms of offensive security frameworks, this maps to MITRE ATT&CK technique T1059.007: Command and Scripting Interpreter via JavaScript, specifically within a web browser context. Understanding these classifications helps in aligning remediation efforts with industry best practices for secure coding and vulnerability management protocols.