CVE-2026-102173

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.

• CWE-79

• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L361
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L389
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L76
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/ElementGenerator.php#L259
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/ExceptionalElements.php#L1079
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/ExceptionalElements.php#L1184
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L308
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/HelperFunctions.php#L1151
• https://plugins.trac.wordpress.org/changeset/3718900/kirki/trunk/includes/Frontend/Preview/ExceptionalElements.php
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3718900%40kirki%2Ftags%2F6.3.2&old=3697265%40kirki%2Ftags%2F6.3.1
• https://www.wordfence.com/threat-intel/vulnerabilities/id/368001e9-3806-41d5-902e-0facf7fb31ff?source=cve

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102164On affected Arista access points configured with VXLAN tunne…3.1
• CVE-2026-102165On affected Arista Wi-Fi access points, an unauthenticated a…7.5
• CVE-2026-102167On affected Arista Wi-Fi access points, a memory corruption …7.5
• CVE-2026-102168On affected Arista Wi-Fi access points with Captive Portal e…6.5
• CVE-2026-102169On affected Arista Wi-Fi access points with Captive Portal e…6.5
• CVE-2026-10217A flaw has been found in nextlevelbuilder GoClaw up to 3.11.…6.3
• CVE-2026-102174A Stack-based Buffer Overflow vulnerability in the iked IKE …8.8
• CVE-2026-102175A Heap-based Buffer Overflow vulnerability in the sdxd servi…9.8
• CVE-2026-102176A Buffer Copy without Checking Size of Input ('Classic Buffe…8.8
• CVE-2026-102177An Out-of-bounds Write vulnerability in the routing protocol…7.6
• CVE-2026-102178A Stack-based Buffer Overflow vulnerability in the BGP routi…9.8
• CVE-2026-102179An Out-of-bounds Write vulnerability in the routing protocol…7.5