CVE-2026-57725: Themeum Kirki Stored XSS Vulnerability

CVE-2026-57725 Overview

CVE-2026-57725 is a stored cross-site scripting (XSS) vulnerability in the Themeum Kirki WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All versions of Kirki through 6.0.11 are affected. Attackers can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The vulnerability requires user interaction and can cross security boundaries, resulting in a scope change per the CVSS vector. The issue was published to the National Vulnerability Database (NVD) on 2026-07-13 and tracked publicly through Patchstack.

Critical Impact
Successful exploitation lets an attacker execute arbitrary JavaScript in an authenticated user's browser session, enabling session theft, administrative account takeover, or persistent site defacement.

Affected Products

Themeum Kirki plugin for WordPress
Kirki versions up to and including 6.0.11
WordPress sites that install or activate the Kirki Customizer Framework

Discovery Timeline

2026-07-13 - CVE-2026-57725 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57725

Vulnerability Analysis

The Kirki plugin extends the WordPress Customizer with additional field types and controls. The vulnerable code paths fail to sanitize or encode user-controlled input before rendering it into HTML output. Because the injected payload is stored server-side, it executes each time a victim loads the affected page. The CVSS scope change indicates the injected script can affect resources beyond the vulnerable component, such as the WordPress admin interface. Exploitation requires user interaction, typically an administrator or editor visiting a page containing the malicious payload.

Root Cause

The root cause is missing or insufficient output encoding when writing user-supplied values into HTML contexts. The plugin trusts input processed through Customizer controls and stores it without server-side validation. When the stored value is later rendered, the browser interprets the payload as active script rather than inert data. This is a canonical instance of [CWE-79], improper neutralization of input during web page generation.

Attack Vector

An attacker with the ability to submit input to a vulnerable Kirki control, or who can coerce a privileged user into submitting attacker-controlled content, injects a JavaScript payload. The payload is stored in the WordPress database. When any user loads the page that renders the stored data, the browser executes the script under the origin of the WordPress site. Verified exploit code is not currently available for this CVE. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-57725

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in Kirki-managed options or postmeta rows.
Outbound HTTP requests from administrator browser sessions to unfamiliar domains immediately after loading Customizer or front-end pages.
New administrator accounts, modified user roles, or unexpected plugin installations following visits by privileged users.

Detection Strategies

Query the wp_options and wp_postmeta tables for Kirki-related keys containing HTML tags or script-like substrings.
Enable and review Content Security Policy (CSP) violation reports to surface inline script execution from unexpected sources.
Correlate WordPress audit logs of Customizer changes with subsequent admin session anomalies.

Monitoring Recommendations

Alert on modifications to Kirki configuration options originating from non-administrator accounts or unusual IP addresses.
Monitor web server logs for requests to Customizer endpoints containing encoded script fragments such as %3Cscript.
Track browser telemetry from privileged workstations for unexpected script execution on WordPress admin URLs.

How to Mitigate CVE-2026-57725

Immediate Actions Required

Identify all WordPress sites running Kirki version 6.0.11 or earlier and prioritize them for patching.
Restrict Customizer access to a minimal set of trusted administrator accounts until a fix is applied.
Audit stored Kirki option values and remove any entries containing script tags or event-handler attributes.

Patch Information

At the time of publication, the advisory lists all versions up to and including 6.0.11 as affected, with no fixed version specified in the NVD entry. Monitor the Patchstack Vulnerability Report and the Themeum Kirki repository for a patched release, and apply it as soon as it becomes available.

Workarounds

Deactivate the Kirki plugin on affected sites until a patched version is released.
Deploy a web application firewall (WAF) rule that blocks script payloads in requests to WordPress Customizer endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and unknown script sources on WordPress admin and front-end pages.

bash

# Example WAF rule concept (ModSecurity) to block script payloads in Customizer requests
SecRule REQUEST_URI "@contains /wp-admin/customize.php" \
  "chain,deny,status:403,id:1057725,msg:'Potential Kirki XSS payload'"
SecRule ARGS "@rx (?i)(<script|javascript:|on\w+\s*=)" "t:none,t:urlDecodeUni"