CVE-2026-102173: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement(), which concatenates a user-meta value straight into an <img src="…"> attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a kirki-register element, which prints the required element nonce into the public markup.
Affected Software
Event History
Frequently Asked Questions
What conditions must be present for exploitation to succeed?
Public user registration must be enabled, and a published page must include a kirki-register element that exposes the required element nonce in public markup. A Kirki users collection must also render an image element bound to one of the nine registration metadata fields.
Does an attacker need an account or other prior privileges?
No. The issue is exploitable by an unauthenticated attacker when the required public registration and page configuration conditions are met.
Who is exposed to the injected script?
The script executes for users who access a page that renders the affected Kirki users collection. The vulnerability has scope changed and can affect confidentiality and integrity, while no availability impact is indicated.
How can I determine whether my site is affected?
Check whether Kirki is version 6.3.1 or earlier, public user registration is enabled, and published pages contain a kirki-register element. Also identify users collections whose image element is bound to any of the nine registration metadata fields.