CVE-2026-84223: Kirki WordPress Plugin XSS Vulnerability

CVE-2026-84223 Overview

CVE-2026-84223 affects the Kirki WordPress plugin before version 6.3.1. The plugin fails to sanitize uploaded Scalable Vector Graphics (SVG) files while enabling SVG uploads site-wide. Authenticated users with author-level access or higher can upload SVG files containing embedded JavaScript. Because the malicious file is served from the site's own origin, the script executes in the browser session of any visitor who opens it, resulting in stored Cross-Site Scripting [CWE-79].

Critical Impact

Author-level accounts can upload weaponized SVG files that execute arbitrary JavaScript in the browser context of any user, including administrators, enabling session theft and account takeover.

Affected Products

• Kirki WordPress plugin versions prior to 6.3.1
• WordPress sites where authors or higher-privileged roles can upload media
• Any site relying on Kirki for theme customization features

Discovery Timeline

• 2026-09-20 - CVE-2026-84223 published to the National Vulnerability Database (NVD)
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-84223

Vulnerability Analysis

The Kirki plugin extends the WordPress media uploader to accept SVG files site-wide. SVG is an XML-based image format that natively supports <script> elements and JavaScript event handlers such as onload and onclick. When an SVG file is served with the image/svg+xml MIME type and rendered directly in a browser tab, embedded scripts execute in the origin of the hosting site.

Kirki performs no sanitization on the uploaded SVG content before storing it in the WordPress uploads directory. An attacker with author privileges can craft an SVG that includes arbitrary JavaScript, upload it through the standard media library, and share the resulting URL. Any authenticated user who follows the link executes the payload with their cookies and session tokens exposed.

Root Cause

The root cause is missing input sanitization on SVG file contents combined with permissive MIME type allowlisting. Kirki does not strip active content such as <script>, <foreignObject>, or on* event attributes before writing the file to disk. WordPress core intentionally blocks SVG uploads for this reason; Kirki reintroduces the risk without applying compensating controls.

Attack Vector

Exploitation requires an authenticated account with author-level access or higher and user interaction to open the malicious file. The attacker uploads a crafted .svg file through the WordPress media library. The plugin stores the file unchanged and returns a URL under the site origin, typically /wp-content/uploads/. When the victim opens the URL, the browser parses the SVG as XML and executes any embedded JavaScript in the site's security context.

The vulnerability mechanism is described in the WPScan Vulnerability Report. No public proof-of-concept exploit code is required beyond a standard SVG payload containing a <script> tag.

Detection Methods for CVE-2026-84223

Indicators of Compromise

• SVG files in /wp-content/uploads/ containing <script> tags, on* event handlers, or <foreignObject> elements
• Media library entries with image/svg+xml MIME type uploaded by author-level accounts
• Outbound requests from administrator browsers to attacker-controlled domains following SVG file access
• New administrator accounts or modified user roles shortly after SVG media uploads

Detection Strategies

• Scan the uploads directory for SVG files and inspect their XML content for active elements
• Correlate WordPress audit logs for wp_handle_upload events involving .svg extensions with subsequent privilege changes
• Deploy a Content Security Policy (CSP) that blocks inline script execution and monitor for CSP violation reports originating from /wp-content/uploads/
• Alert on media library uploads by non-administrative roles when the file type is SVG

Monitoring Recommendations

• Enable WordPress activity logging plugins to capture user, timestamp, and filename for every upload
• Forward web server access logs to a centralized log store and query for GET requests to .svg assets followed by session anomalies
• Track author and editor account creation and role escalation events
• Review Kirki plugin version across all managed WordPress instances on a recurring schedule

How to Mitigate CVE-2026-84223

Immediate Actions Required

• Upgrade the Kirki plugin to version 6.3.1 or later on every affected WordPress installation
• Audit the /wp-content/uploads/ directory for existing SVG files and remove any containing script content
• Review author, editor, and administrator accounts and disable those that are unused or unrecognized
• Rotate authentication cookies and force re-login for privileged users if suspicious SVG uploads are found

Patch Information

The vendor addressed CVE-2026-84223 in Kirki version 6.3.1 by adding sanitization to uploaded SVG files. Details are documented in the WPScan Vulnerability Report. Administrators should verify the installed version via the WordPress plugins dashboard and apply the update through automatic updates or manual replacement.

Workarounds

• Disable the Kirki plugin until the patched version can be deployed
• Restrict the author role from uploading files by removing the upload_files capability with a role management plugin
• Configure the web server to force Content-Disposition: attachment for .svg files so browsers download rather than render them
• Deploy a web application firewall rule that blocks uploads of SVG files containing <script> or on* attributes

# Nginx configuration to force SVG download rather than inline rendering
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
}