CVE-2026-12724: Kirki WordPress Plugin XSS Vulnerability

CVE-2026-12724 Overview

CVE-2026-12724 affects the Kirki WordPress plugin in versions prior to 6.0.12. The plugin fails to sanitize or escape the email subject and body values submitted in a request before including them in the HTML password-reset email sent to registered users. Unauthenticated attackers can inject arbitrary HTML into messages delivered to legitimate users, enabling convincing phishing campaigns that appear to originate from the affected WordPress site. The flaw is tracked under [CWE-345] (Insufficient Verification of Data Authenticity) and requires user interaction to succeed. WPScan published the vulnerability report documenting the issue.

Critical Impact
Unauthenticated attackers can inject arbitrary HTML into password-reset emails, enabling phishing attacks against registered WordPress users of sites running vulnerable Kirki versions.

Affected Products

Kirki WordPress plugin versions prior to 6.0.12
WordPress sites bundling Kirki as a theme dependency
WordPress installations exposing the password-reset workflow to unauthenticated users

Discovery Timeline

2026-07-20 - CVE-2026-12724 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-12724

Vulnerability Analysis

The Kirki plugin generates password-reset emails using HTML content. The plugin accepts subject and body values from incoming requests and embeds them directly into the outbound email. Because the plugin performs no sanitization or output escaping on these values, an attacker can inject arbitrary HTML markup into the message body. The email arrives from the legitimate WordPress site's mail infrastructure, so DKIM, SPF, and DMARC signatures validate correctly. Recipients see a message that appears authentic in every technical respect, yet contains attacker-controlled HTML content.

The attack requires user interaction (UI:R), meaning the victim must click a crafted link or open the delivered email and interact with the injected content. The confidentiality impact is none, but integrity is affected because the message body is no longer trustworthy. EPSS scoring places this vulnerability in a low likelihood range for exploitation activity.

Root Cause

The root cause is missing input sanitization and output escaping in the password-reset email generation routine. The plugin trusts request-supplied subject and body parameters and inserts them into an HTML email template without applying wp_kses, esc_html, or equivalent escaping. This violates WordPress secure coding guidance for handling untrusted input in outbound mail.

Attack Vector

An unauthenticated remote attacker issues a request to the vulnerable password-reset endpoint targeting a known registered email address. The attacker supplies crafted subject and body values containing HTML markup, such as anchor tags pointing to attacker-controlled phishing pages, fake login prompts, or misleading branding. The WordPress site sends the email through its legitimate mail transport. The recipient receives what appears to be an authentic password-reset message and may click embedded links or follow instructions that lead to credential theft.

No verified public proof-of-concept code is available. Consult the WPScan vulnerability report for technical specifics of the injection point.

Detection Methods for CVE-2026-12724

Indicators of Compromise

Outbound password-reset emails from the WordPress site containing unexpected HTML elements, external links, or unfamiliar branding
Password-reset requests originating from unfamiliar IP addresses targeting valid user email addresses
User reports of suspicious password-reset messages they did not initiate

Detection Strategies

Inspect web server access logs for POST requests to the Kirki password-reset endpoint containing HTML characters such as <, >, or URL-encoded equivalents in subject or body parameters
Deploy WordPress security plugins configured to log and alert on password-reset activity, particularly bursts targeting multiple accounts
Review the installed Kirki plugin version through the WordPress admin dashboard and confirm it is 6.0.12 or later

Monitoring Recommendations

Monitor outbound mail queues for password-reset messages containing anchor tags to external domains not owned by the site operator
Track rate and volume of password-reset requests per source IP address and alert on anomalies
Correlate password-reset request logs with successful login events to identify potential credential compromise following phishing

How to Mitigate CVE-2026-12724

Immediate Actions Required

Update the Kirki plugin to version 6.0.12 or later on all WordPress installations
Audit outbound password-reset email logs for injected HTML content dating back several weeks
Notify users who received suspicious password-reset emails and require credential rotation where phishing is suspected

Patch Information

The vendor addressed the issue in Kirki 6.0.12 by sanitizing and escaping the subject and body values before including them in the password-reset email HTML template. Site administrators should update through the WordPress plugin management interface or by deploying the updated plugin package. Refer to the WPScan advisory for reference.

Workarounds

Deploy a Web Application Firewall rule blocking HTML characters in password-reset request parameters until the plugin is updated
Disable the Kirki plugin's password-reset functionality if not required by the site's theme or workflow
Restrict access to the password-reset endpoint by IP address where operationally feasible

bash

# Update Kirki plugin using WP-CLI
wp plugin update kirki --version=6.0.12

# Verify installed version
wp plugin get kirki --field=version