CVE-2026-14572 in Kirki Plugin
Summary
by MITRE • 10/15/2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within the Kirki – Freeform Page Builder plugin for WordPress represents a significant security risk stemming from inadequate handling of user-supplied data during content creation and rendering processes. Specifically, this flaw is classified as a Stored Cross-Site Scripting (XSS) vulnerability that affects all versions up to and including 6.2.0. The root cause lies in the insufficient input sanitization and output escaping mechanisms applied when processing text content within the Page Builder interface. Unlike reflected XSS attacks where malicious scripts are executed immediately via a crafted URL, stored vulnerabilities persist by saving the injected payload into the application's database or file system. In this context, the attacker injects arbitrary web scripts through the page builder’s text fields, which are then permanently stored on the server side without proper validation against executable code patterns.
From an operational perspective, the impact of this vulnerability is severe because it allows for persistent compromise of website visitors rather than just the initial attacker. Once a malicious script is embedded into a page via the Page Builder Text Content feature, every user who accesses that specific page will have their browser execute the injected JavaScript in the context of the vulnerable site. This can lead to session hijacking, where attackers steal administrative cookies or authentication tokens to gain unauthorized access to the WordPress dashboard. It also enables defacement of the website content, redirection of users to malicious phishing sites designed to harvest credentials, and potentially the installation of further malware on visitor devices through drive-by download techniques if combined with other browser vulnerabilities.
The exploitation vector for this vulnerability requires a specific level of privilege within the WordPress environment. The attacker must be an authenticated user who has been granted the kirki_content_access capability by an administrator. This requirement means that while external unauthenticated attackers cannot directly exploit this flaw, it poses a substantial risk in multi-author environments or if any subscriber-level account is compromised and subsequently elevated to have content editing privileges. Attackers often target these lower-privileged accounts through credential stuffing, phishing, or exploiting other less severe vulnerabilities on the same site to gain initial access before leveraging their limited permissions to inject malicious scripts into publicly accessible pages.
This vulnerability maps directly to CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism here involves a failure in both input validation and output encoding, allowing raw script tags or event handlers like onerror or onload to be rendered by the browser without being escaped into safe HTML entities. Furthermore, from an offensive security framework perspective such as MITRE ATT&CK for Enterprise, this behavior aligns with techniques related to Client-Side Scripting Injection (T1059) and potentially Taint-and-Check failures where trusted sources are not properly sanitized before use in sensitive contexts like DOM manipulation or HTML rendering.
To mitigate the risks associated with this vulnerability, immediate action is required for all sites running affected versions of the Kirki plugin. The primary remediation step is to upgrade the plugin to a version later than 6.2.0 where these sanitization and escaping issues have been addressed by the developers. Administrators should also review user roles and capabilities within WordPress to ensure that only trusted individuals with verified identities are granted the kirki_content_access capability, thereby reducing the attack surface for potential insider threats or compromised low-privilege accounts. Implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common XSS payloads in HTTP requests before they reach the application logic. Regular security audits and code reviews focusing on input sanitization practices are essential to prevent similar vulnerabilities from being introduced during future updates or custom development work within the WordPress ecosystem.