CVE-2026-84223 — Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload…
Published: 2026-09-20 · CVSS: 6.8 · CVSS 3.1
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7