CVE-2026-16974 Overview
CVE-2026-16974 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. The flaw affects all plugin versions up to and including 6.2.0. The vulnerability resides in the post_meta shortcode, which fails to properly sanitize input and escape output. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page, enabling session theft, redirection, and content manipulation. The issue is classified under CWE-79.
Critical Impact
Authenticated contributors can store JavaScript that runs in the browser of any visitor to an injected page, including administrators.
Affected Products
- Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
- All versions up to and including 6.2.0
- WordPress sites allowing Contributor-level accounts or higher
Discovery Timeline
- 2026-08-11 - CVE-2026-16974 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-16974
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw located in the plugin's post_meta shortcode handler. The shortcode retrieves post metadata and renders it into page output without sufficient sanitization on input or contextual escaping on output. An attacker with Contributor privileges can craft a post that embeds the post_meta shortcode referencing attacker-controlled meta values containing HTML or JavaScript payloads. When a subsequent viewer, including higher-privileged users such as editors or administrators, loads the page, the payload executes in their browser session. This creates an authenticated-to-privileged escalation path through the WordPress editorial workflow, since contributors typically submit content for review by editors and administrators.
Root Cause
The root cause is insufficient input sanitization and output escaping within the post_meta shortcode implementation. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses_post() for contextual output escaping, and sanitize_text_field() for input handling. The affected shortcode did not apply these controls, allowing raw HTML and script tags to be persisted and rendered.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account with the Contributor role or above. The attacker embeds the vulnerable shortcode with a payload in a draft post or page. Upon rendering, the payload executes in the victim's browser. The scope change reflects the ability to impact users beyond the attacker's privilege level, including administrators reviewing the submission.
See the Wordfence Vulnerability Report for additional technical context. No public proof-of-concept code is verified at this time.
Detection Methods for CVE-2026-16974
Indicators of Compromise
- Posts or pages containing [post_meta] shortcodes with unusual key parameters or unexpected content authored by Contributor-level accounts
- Post meta values that include <script> tags, on* event handlers, or javascript: URIs
- Unexpected outbound requests from administrator browsers shortly after reviewing pending Contributor submissions
- New administrator accounts or role changes correlated with content review sessions
Detection Strategies
- Audit the wp_postmeta table for values containing HTML tags, script elements, or event handler attributes
- Review recent posts submitted by Contributor accounts for use of the post_meta shortcode
- Enable WordPress activity logging to capture shortcode-bearing content creation and edits
- Deploy a web application firewall rule to identify script payloads in post_content and post meta submissions
Monitoring Recommendations
- Monitor WordPress audit logs for content submissions from low-privilege accounts that use dynamic shortcodes
- Alert on administrator session anomalies such as unexpected API calls to /wp-admin/users.php or /wp-json/wp/v2/users after content review
- Track plugin version inventory across managed WordPress instances to confirm patch status of Kirki
How to Mitigate CVE-2026-16974
Immediate Actions Required
- Update the Kirki plugin to the version published in WordPress plugin changeset 3636487
- Audit existing Contributor and Author accounts and remove any that are unnecessary or inactive
- Review recently published or pending posts for embedded post_meta shortcodes and script content
- Rotate administrator session cookies and credentials if suspicious content was reviewed
Patch Information
The vendor addressed the issue in the changeset referenced by the WordPress Change Log Entry. Site operators should upgrade beyond version 6.2.0 to a patched release. Confirm the installed version via the WordPress admin Plugins page or by inspecting the plugin's main file header.
Workarounds
- Deactivate the Kirki plugin until a patched version is applied
- Restrict the Contributor role or require editorial approval workflows that render content in a sandboxed preview
- Apply a web application firewall rule to block shortcode payloads containing <script>, on*=, or javascript: values
- Use a content security policy (CSP) header that disallows inline scripts to reduce XSS execution impact
# Example: WP-CLI commands to inventory and update Kirki
wp plugin get kirki --field=version
wp plugin update kirki
# Search post meta for suspicious payloads
wp db query "SELECT post_id, meta_key, meta_value FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%javascript:%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
