CVE-2026-84223: Unknown Kirki

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

Affected products

• Unknown Kirki: from 6.0.0, before 6.3.1 (fixed in 6.3.1)

Published 2026-09-20. Last modified 2026-09-21.