CVE-2026-102173: Kirki WordPress Plugin XSS Vulnerability

CVE-2026-102173 Overview

CVE-2026-102173 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. The flaw affects all versions up to and including 6.3.1. It stems from insufficient output escaping in the ExceptionalElements::image_element() function, which concatenates user-meta values directly into an <img src="…"> attribute. Unauthenticated attackers can inject arbitrary JavaScript that executes when visitors load a page rendering a Kirki users collection bound to one of nine registration meta fields.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into public WordPress pages when user registration is enabled and a page contains a kirki-register element.

Affected Products

Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
All versions up to and including 6.3.1
Fixed in version 6.3.2

Discovery Timeline

2026-10-07 - CVE-2026-102173 published to the National Vulnerability Database (NVD)
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102173

Vulnerability Analysis

The vulnerability lives in the Kirki plugin's frontend preview renderer. The ExceptionalElements::image_element() method retrieves a user-meta value and inlines it into an <img> tag's src attribute without escaping. Because the data path originates from a registration form field writable by unauthenticated users, attacker-controlled markup reaches a rendered public page unaltered.

Exploitation requires two preconditions: public user registration must be enabled on the WordPress site, and a published page must include a kirki-register element. That element prints the required nonce into the public markup, which lets unauthenticated attackers submit the registration form and persist crafted values into the targeted meta fields.

When a visitor renders the Kirki users collection, the stored payload executes in their browser session. Impact includes session theft, forced administrative actions through CSRF chains, redirects, and account takeover against authenticated users who browse the affected page.

Root Cause

The root cause is missing output escaping in includes/Frontend/Preview/ExceptionalElements.php. The image_element() routine concatenates a raw user-meta string into an HTML attribute instead of passing it through esc_url() or esc_attr(). The CWE-79 classification confirms improper neutralization of input during web page generation.

Attack Vector

An unauthenticated attacker locates a published page containing a kirki-register element and extracts the embedded nonce. The attacker then submits the registration form with a payload placed in one of the nine registration meta fields consumed by the image element. On subsequent views of any page rendering the Kirki users collection, the payload executes against each visitor's browser.

For technical details on the affected code paths, see the WordPress Kirki Exceptional Elements source and the Wordfence vulnerability record.

Detection Methods for CVE-2026-102173

Indicators of Compromise

User-meta records for registered accounts containing HTML control characters, javascript: URIs, or on*= event-handler strings.
Unexpected <script> tags or malformed <img src> attributes in rendered pages that include a Kirki users collection.
Spikes in anonymous registrations preceded by requests to pages hosting a kirki-register element.

Detection Strategies

Audit the WordPress wp_usermeta table for the nine Kirki registration fields and flag values containing angle brackets, quotes, or URL schemes other than http/https.
Review web server access logs for POST requests to endpoints handled by CompLibFormHandler.php originating from unauthenticated sessions.
Compare installed Kirki plugin versions against the fixed release 6.3.2 across all managed WordPress sites.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to catch inline script execution on pages that render Kirki elements.
Alert on new user registrations immediately followed by profile metadata updates containing script-like payloads.
Monitor outbound requests from browsers of authenticated administrators that correlate with visits to Kirki-rendered pages.

How to Mitigate CVE-2026-102173

Immediate Actions Required

Update the Kirki plugin to version 6.3.2 or later on every affected WordPress installation.
Temporarily disable public user registration if the patch cannot be applied immediately.
Review and sanitize existing user-meta values written by the Kirki registration form before re-enabling affected pages.

Patch Information

The vendor addressed the issue in Kirki version 6.3.2. The fix is documented in WordPress Kirki Changeset #3718900 and the full diff between 6.3.1 and 6.3.2. The patch introduces proper escaping of user-meta values before they are inserted into the <img src> attribute.

Workarounds

Unpublish or remove any page containing a kirki-register element until the plugin is updated.
Disable WordPress public registration via Settings → General by clearing the "Anyone can register" option.
Deploy a web application firewall (WAF) rule to block registration submissions whose field values contain <, >, ", or javascript: sequences.

bash

# Verify installed Kirki version via WP-CLI and update
wp plugin get kirki --field=version
wp plugin update kirki --version=6.3.2

# Disable public registration until patched
wp option update users_can_register 0