CVE-2026-57725 in Kirki Plugin
Summary
by MITRE • 07/13/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/13/2026
The vulnerability described represents a critical cross-site scripting weakness within the Themeum Kirki plugin, specifically impacting versions up to and including 6.0.11. This flaw falls under the well-established CWE-79 category for cross-site scripting, where malicious scripts can be injected into web pages viewed by other users. The vulnerability occurs during web page generation when input validation and sanitization mechanisms fail to properly neutralize user-supplied data before it is rendered in web content.
The technical implementation of this stored XSS vulnerability stems from insufficient input filtering within the Kirki configuration system. When administrators or users provide input through the plugin's interface, the data flows directly into the generated HTML output without adequate sanitization processes. This allows attackers to inject malicious JavaScript code that persists in the application's database and executes whenever legitimate users view affected pages. The stored nature of this vulnerability means that once exploited, the malicious payload remains active until manually removed from the system.
Operational impact assessment reveals significant security implications for WordPress installations utilizing vulnerable Kirki versions. Attackers can leverage this vulnerability to hijack user sessions, steal sensitive information, manipulate content displayed to other users, or redirect victims to malicious websites. The attack surface extends beyond individual site compromise to potentially affect entire user bases if the plugin is widely deployed across multiple sites. This vulnerability particularly threatens sites with administrative access or those handling sensitive user data through Kirki-powered customization options.
Mitigation strategies should prioritize immediate patching of affected installations to version 6.0.12 or later, which contains the necessary input sanitization fixes. System administrators must also implement additional defensive measures including web application firewall rules to detect and block suspicious script patterns, regular security auditing of plugin configurations, and user access controls limiting administrative privileges. Organizations should conduct comprehensive vulnerability assessments across all WordPress installations and review custom themes that may integrate Kirki functionality. The ATT&CK framework categorizes this vulnerability under T1566 for credential access through social engineering and T1059 for command and control through scripting languages, emphasizing the multi-faceted attack vectors possible with stored XSS implementations. Security monitoring should include detection of unusual data injection patterns and regular scanning for malicious code within plugin directories to prevent exploitation attempts.