WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

kirki · CWE-80 · CWE-80

Affectedkirki

FixUpdate to 6.4.1 or newer

PublishedOct 29, 15:05 · Patchstack

ScoredOct 29 · 4.3 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inkirkiearlier versions6.4.1

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-4-0-content-injection-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in kirki

All 11 →

6.5Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token · CVE-2026-112348Oct 30 7.6Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API · CVE-2026-112347Oct 30 8.2WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability · CVE-2026-103065Oct 3