CVE-2026-17037: WordPress Kirki Plugin XSS Vulnerability

CVE-2026-17037 Overview

CVE-2026-17037 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. The flaw affects all versions up to and including 6.2.0. Unauthenticated attackers can inject arbitrary JavaScript through the comment parameter due to insufficient input sanitization and output escaping. The injected script executes in the browser of any user who visits an affected page. The vulnerability maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can persist JavaScript payloads into WordPress pages, enabling session theft, credential harvesting, and site defacement against every visitor.

Affected Products

Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress
All plugin versions through 6.2.0
WordPress sites where the plugin is installed and active

Discovery Timeline

2026-09-11 - CVE-2026-17037 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-17037

Vulnerability Analysis

The Kirki plugin fails to sanitize input received through the comment parameter before storing it, and does not escape the stored value on output. An unauthenticated attacker submits a crafted payload containing HTML or JavaScript, which the plugin persists to the site database. When any user later renders the affected page, the browser parses the attacker payload as executable script within the site's origin.

Because the attack requires no authentication and the payload is stored server-side, a single request can affect every subsequent visitor to the impacted page. The scope change reflected in the vulnerability rating indicates the injected script executes in a security context different from the vulnerable component itself, enabling attackers to reach administrator sessions and other privileged browser contexts.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the comment parameter. WordPress provides functions such as sanitize_text_field(), wp_kses_post(), and esc_html() to prevent this class of flaw, but the vulnerable code path in Kirki 6.2.0 and earlier does not apply them to this parameter.

Attack Vector

An unauthenticated remote attacker submits an HTTP request containing a script payload in the comment parameter to the vulnerable endpoint exposed by the plugin. The payload is stored and then rendered without escaping. Any subsequent visitor, including authenticated administrators, executes the injected JavaScript in their browser session. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details.

Detection Methods for CVE-2026-17037

Indicators of Compromise

HTTP POST or GET requests to Kirki plugin endpoints containing <script>, onerror=, onload=, or JavaScript URI schemes within the comment parameter.
Unexpected <script> tags, iframes, or event handlers rendered inside pages managed by the Kirki plugin.
Outbound browser connections from site visitors to attacker-controlled domains hosting credential-harvesting or beaconing code.
New or modified administrator accounts created shortly after suspicious visits to injected pages.

Detection Strategies

Inspect web server access logs for requests containing URL-encoded angle brackets or common XSS payload patterns targeting Kirki endpoints.
Run database queries against wp_posts and Kirki-managed tables to search for stored <script, javascript:, or on*= strings in the comment field.
Deploy a web application firewall rule that blocks HTML control characters in the comment parameter for Kirki request paths.
Compare page rendering with a known-good baseline using content integrity monitoring to flag injected DOM elements.

Monitoring Recommendations

Alert on newly created or modified administrator accounts and role changes in WordPress.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages served by the plugin.
Track anomalous session activity from administrator accounts, including logins from new geographies or user agents.
Ingest WordPress and web server logs into a centralized data lake and correlate injection attempts with post-exploitation actions.

How to Mitigate CVE-2026-17037

Immediate Actions Required

Update the Kirki plugin to a version later than 6.2.0 that contains the fix referenced in the WordPress Plugin Changeset.
If a patched version is not yet available for your deployment, deactivate the Kirki plugin until a fix can be applied.
Audit all pages managed by the plugin for stored payloads and remove any injected script content from the database.
Rotate credentials and session tokens for administrator accounts that may have interacted with a compromised page.

Patch Information

The upstream fix is published in the WordPress Plugin Changeset 3636487, which introduces proper sanitization and output escaping for the comment parameter. Site owners should apply the update through the WordPress plugin manager or WP-CLI as soon as the patched release is available in their update channel.

Workarounds

Deploy a web application firewall rule to block requests containing script tags or event-handler attributes in the comment parameter.
Implement a strict Content Security Policy that disallows inline scripts and untrusted external script sources.
Restrict access to Kirki plugin endpoints through IP allowlisting where feasible.
Disable or remove the plugin on sites that do not require its functionality.

bash

# Update the Kirki plugin using WP-CLI
wp plugin update kirki

# Verify installed plugin version
wp plugin get kirki --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate kirki