Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-84223: Kirki plugin allows author to run JavaScript via SVG
CVE-2026-84223 · published 1 month ago
Summary
The Kirki add‑on for WordPress (versions 6.0.0 through 6.3.0) lets users with author or higher permissions upload SVG images that are not cleaned of code. A malicious SVG can contain JavaScript that runs whenever anyone views the file, potentially stealing data or hijacking the session. Update the plugin to version 6.3.1 or later, or remove the ability for authors to upload SVG files until the fix is applied.
What to do
- Update unknown kirki to version 6.3.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | kirki | < 6.3.1 |
Original advisory text
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.8
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published20 Sep 2026
Updated4 Nov 2026
First seen20 Sep 2026
Track software like this
Free during beta