CVE-2026-66629: WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

Q: Which deployments are in scope?

Sites using Kirki version 6.2.3 or earlier are affected according to the available information. The data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication, but exploitation requires user interaction. The provided data does not specify the required interaction or delivery method.

Q: How serious is successful exploitation?

The vulnerability has network attack vector and low attack complexity, with no privileges required. Its listed impacts include low confidentiality, integrity, and availability impact, and the scope is changed.

Published Aug 18, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Affected Software

1 affected component

wordpress/kirki<=6.2.3

Event History

Aug 18, 2026

CVE Published

via MITRE·01:59 PM

Data Sourced

via MITRE·01:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are in scope?

Sites using Kirki version 6.2.3 or earlier are affected according to the available information. The data does not identify a fixed version.

What does an attacker need to exploit this issue?

An attacker does not need authentication, but exploitation requires user interaction. The provided data does not specify the required interaction or delivery method.

How serious is successful exploitation?