Unrated severityNVD Advisory· Published Sep 20, 2026

CVE-2026-84223

Description

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/02ed6d31-84f3-4723-8b49-ddb00c7db7d3/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000