CVE-2026-14572: Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirkicontentaccess capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the kirki_content_access capability, which is granted by an administrator. The issue does not describe exploitation by unauthenticated users or by users without that capability.
When does the injected script execute?
The malicious script is stored in Page Builder text content and executes whenever a user accesses the affected page. This can affect any user who views a page containing the injected content.
Are default WordPress installations affected?
The available information only identifies Kirki installations through version 6.2.0 as affected. Exploitation additionally requires an administrator to grant the kirki_content_access capability; whether that capability is granted by default is not stated.
What should be checked while remediation is underway?
Review Page Builder text content for unexpected or untrusted script-like content, particularly content created or modified by accounts holding kirki_content_access. Also review which accounts have that capability, since it is required for exploitation.