CVE-2026-14572— Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
Quick assessment
Affected
themeum Kirki – Freeform Page Builder, Website Builder & Customizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 中的 Kirki – Freeform Page Builder, Website Builder & Customizer 插件在 6.2.0 及以下所有版本中存在存储型跨站脚本漏洞（Stored Cross-Site Scripting, XSS）。该漏洞源于对页面构建器文本内容的输入清理和输出转义不足。攻击者在拥有管理员授予的 kirki_content_access 权限的情况下，可以在页面中注入任意 Web 脚本，当其他用户访问被注入的页面时，这些脚本将会被执行。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScriptAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| themeum | Kirki – Freeform Page Builder, Website Builder & Customizer | ≤ 6.2.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14572
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
Source: CVE Program / CVE List V5
Vulnerability Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themeum | Kirki – Freeform Page Builder, Website Builder & Customizer | 0 ~ 6.2.0 | - |
|
II. Public POCs for CVE-2026-14572
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14572
请登录查看更多情报信息。
Other References for CVE-2026-14572 (2)
IV. Related Vulnerabilities
-
CVE-2026-104734
Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object I -
CVE-2026-107762
Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthe -
CVE-2026-102291
Kirki – Freeform Page Builder, Website Builder & Customizer -
CVE-2026-102173
Kirki – Freeform Page Builder, Website Builder & Customizer -
CVE-2026-18335
Kirki – Freeform Page Builder, Website Builder & Customizer
Same vendor: themeum
-
CVE-2026-92715
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Aut -
CVE-2026-104734
Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object I -
CVE-2026-107762
Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthe -
CVE-2026-93681
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-88963
Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected D
Same weakness: CWE-79
-
CVE-2026-103899
EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthen -
CVE-2026-109989
Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cros -
CVE-2026-111726
Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stor -
CVE-2026-96660
User Registration & Membership <= 5.2.8 - Unauthenticated St -
CVE-2026-109985
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching &
V. Comments for CVE-2026-14572
No comments yet