CVE-2026-84223: Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with author-level access or higher can upload an SVG containing JavaScript. The script executes in the session of a user who opens the uploaded file.
Which deployments are affected?
Kirki versions 6.0.0 through 6.3.0 are affected. The plugin makes SVG uploads available site-wide and does not sanitize the uploaded SVG content.
What should be done if updating is not immediately possible?
Restrict or remove author-and-higher users' ability to upload SVG files until the plugin can be updated. Review uploaded SVG files for embedded JavaScript and remove suspicious uploads.
How can I determine whether the site may already be affected?
Check whether Kirki is running a version before 6.3.1 and review SVG files uploaded by author-level or higher accounts. Uploaded SVGs containing JavaScript are potentially malicious and can execute when opened.