CVE-2026-16974: Kirki WordPress Plugin Stored XSS in 500,000+ Sites
The Kirki page builder plugin for WordPress, active on over 500,000 sites, contains a stored cross-site scripting vulnerability in its post_meta shortcode. Authenticated users with Contributor access can inject malicious JavaScript into pages. Fixed in version 6.2.1.
Contents
TL;DR: The Kirki page builder plugin for WordPress, active on over 500,000 sites, contains a stored cross-site scripting vulnerability in its post_meta shortcode. Any authenticated user with Contributor-level access or higher can inject malicious JavaScript into pages that executes when visitors load the affected page. The fix is available in version 6.2.1.
What is Kirki
Kirki is a freeform page builder and website builder for WordPress, developed by Themeum. It gives designers, freelancers, and agencies a visual drag-and-drop canvas for building complete websites without writing code. The plugin includes built-in forms, popups, maps, SEO tools, and a theme customizer. WordPress.org lists it with 500,000+ active installations, placing it among the top 150 plugins on the platform by install count.
Version 6.2.0 was the current release when this vulnerability was disclosed. Themeum released version 6.2.1 as the patched version.
What happened
The vulnerability exists in Kirki's post_meta shortcode. WordPress shortcodes are bracketed tags like [post_meta key="some_field"] that plugins use to inject dynamic content into posts and pages. Kirki's implementation of this shortcode does not properly sanitize user input before rendering it into the page HTML.
An attacker authenticated as a Contributor or higher can embed a malicious post_meta shortcode in a post. When a visitor or administrator loads that page, the unsanitized payload executes as JavaScript in their browser. The scope is not limited to the attacker's own content: because the script is stored in the post body, it runs for every user who views the page, including admins who could have their session tokens stolen.
This is a stored XSS, which means the payload persists in the WordPress database until the post is edited or removed. The attacker does not need to maintain access after the initial injection. A single compromised Contributor account can plant scripts that run indefinitely.
Who is affected
All sites running Kirki version 6.2.0 or earlier are vulnerable. The exploit requires an authenticated user with at least Contributor-level access. On most WordPress sites, Contributor is a low-trust role: they can create draft posts but cannot publish them. An attacker who gains Contributor access through a separate vulnerability, a weak password, or a social engineering vector can use this bug to escalate their reach to full admin compromise via stored XSS targeting the admin panel.
The affected package is Kirki - Freeform Page Builder, Website Builder & Customizer by Themeum, available through the WordPress.org plugin directory. The CVE record identifies versions up to and including 6.2.0 as vulnerable.
What to do
Update Kirki to version 6.2.1 or later immediately. The patched release is available through the WordPress admin dashboard under Plugins > Installed Plugins, or by downloading it directly from the WordPress.org plugin page.
If you cannot update right away, restrict Contributor and Author role access on your WordPress site. Contributors should not have the ability to embed arbitrary shortcodes in post content. Consider using a role management plugin to limit what shortcodes are available to low-privilege users.
Audit your post content for suspicious post_meta shortcode usage. Look for shortcodes containing <script> tags, onerror attributes, or encoded JavaScript payloads in any post authored by Contributors.
Why it matters
500,000+ active installations makes this a significant attack surface. WordPress plugins that run on hundreds of thousands of sites are frequent targets for mass exploitation once a proof of concept is published. Stored XSS vulnerabilities in WordPress are particularly dangerous because they can target administrators: if an admin views an infected page, the attacker's JavaScript can create new admin accounts, install backdoor plugins, or modify site settings.
The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities catalog. No public proof of concept was available at time of writing. NVD enrichment data is pending, so no CVSS score has been assigned by NIST yet.
References
Continue reading
All posts
CVE-2026-73033: Sucuri WordPress Security Plugin Path Traversal Allows Arbitrary File Deletion
Sucuri Security WordPress plugin through 2.7.3 contains a path traversal vulnerability in its file integrity scanner allowing authenticated admins to delete arbitrary files including wp-config.php. 600K active installs.
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.