CVE-2026-12724 in Kirki Plugin
Summary
by MITRE • 07/20/2026
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability resides within the Kirki WordPress plugin version 6.0.11 and earlier, where insufficient input validation and sanitization mechanisms fail to properly process email subject and body parameters during password reset functionality. This flaw represents a classic cross-site scripting vulnerability in email contexts, specifically categorized under CWE-79 as improper neutralization of input during web page generation. The plugin accepts user-supplied values through HTTP request parameters without adequate sanitization before incorporating them into HTML-formatted email content that gets delivered to registered users.
Security researchers have identified that unauthenticated attackers can exploit this vulnerability by crafting malicious requests containing specially formatted HTML content in the email subject and body fields. When the password reset email is generated, these unsanitized values are directly embedded into the email's HTML structure without proper escaping or encoding mechanisms. The resulting email message contains injected HTML elements that can execute within the recipient's email client environment, particularly when users interact with the phishing content.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables sophisticated phishing attacks against registered users who receive password reset emails containing malicious embedded content. Attackers could inject JavaScript code, malformed HTML tags, or deceptive elements that attempt to capture user credentials or redirect them to malicious domains. The attack vector requires no authentication, making it particularly dangerous as anyone can exploit this weakness without prior access to the system. This vulnerability directly maps to attack techniques described in the MITRE ATT&CK framework under T1566 for credential harvesting and T1204 for user execution through malicious email content.
The technical exploitation occurs when an attacker sends a request to the password reset endpoint with crafted subject and body parameters containing HTML injection payloads. These payloads bypass standard security controls by leveraging the fact that email clients often render HTML content without additional sanitization, particularly in password reset scenarios where users may be more likely to interact with received emails due to legitimate account recovery expectations. The vulnerability essentially creates a server-side template injection scenario where user-controllable input directly influences email rendering.
Mitigation strategies should focus on implementing strict input sanitization and output encoding mechanisms for all user-supplied content used in email generation processes. The plugin must enforce proper HTML escaping before inserting any dynamic values into email templates, ensuring that special characters are properly encoded to prevent HTML interpretation. Organizations should immediately update to Kirki version 6.0.12 or later where the vulnerability has been patched through proper input validation and sanitization controls. Additionally, administrators should implement email security measures including content filtering and sandboxing for password reset emails to reduce potential impact even if exploitation occurs.
The remediation process involves comprehensive code review of all email generation functions within the plugin, ensuring that any user-controllable parameters undergo strict sanitization before HTML insertion. Security testing should include dynamic analysis of email content generation pathways to validate that no malicious HTML injection can occur through parameter manipulation. System administrators must also consider implementing email authentication mechanisms such as dkim and spf to reduce the effectiveness of phishing attempts that may exploit this vulnerability, while regular security audits should verify proper implementation of input validation across all plugin components handling user data in email contexts.