CVE-2026-42694: WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Kirki pluginto a version that resolves this vulnerability.Fixed in 6.4.1
Event History
Frequently Asked Questions
Who needs to be authenticated to exploit this issue?
The reported vector requires low-level privileges (PR:L). An unauthenticated attacker is not indicated by the available CVSS vector.
Does exploitation require user interaction or complex conditions?
No user interaction is required, and the attack complexity is rated low. The vulnerability is remotely reachable over the network.
What is the expected impact if exploitation succeeds?
The reported impact is limited confidentiality impact, with no integrity or availability impact in the supplied CVSS vector. The issue is categorized as basic XSS/content injection and code injection.
Which Kirki versions are affected?
Kirki versions through 6.4.0 are reported as affected. The provided data does not identify a fixed version.