CVE-2026-84219— Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
Quick assessment
Affected
Unknown Kirki
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kirki WordPress 插件在 6.3.0 之前的版本，在渲染时未能完全阻止其解码的所有 HTML 实体拼写变体，使得未经身份验证的用户可以在评论中存储 JavaScript 代码。当页面显示该评论时，这段代码会在查看该页面的任何用户（包括管理员）的浏览器会话中执行；如果网站的页眉或页脚被设置为显示评论，则它还会在网站的每个页面上执行。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84219
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
Source: CVE Program / CVE List V5
Vulnerability Description
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84219
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84219
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-84219 (1)
-
🔗 Kirki 6.2.1 – 6.2.5 – Unauthenticated Stored XSS via HTML Entity Decoding | CVE 2026-84219 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-06 · 6 CVEs total
| CVE-2026-85038 | B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registrati | |
| CVE-2026-75793 | SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login | |
| CVE-2026-18480 | SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover | |
| CVE-2026-84028 | Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settin | |
| CVE-2026-13159 | Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation |
IV. Related Vulnerabilities
Same product: Kirki
-
CVE-2026-84225
Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment St -
CVE-2026-84221
Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field -
CVE-2026-77754
Kirki < 6.0.14 - Unauthenticated User and Comment Author Ema -
CVE-2026-74992
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload -
CVE-2026-66629
WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS)
Same vendor: Unknown
-
CVE-2026-85038
B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and -
CVE-2026-75793
SureCart < 4.7.0 - Unauthenticated Account Creation with Aut -
CVE-2026-18480
SureCart < 4.6.3 - Subscriber+ Administrator Account Takeove -
CVE-2026-84028
Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slid -
CVE-2026-13159
Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation
V. Comments for CVE-2026-84219
No comments yet