Security
Loading…

CVE-2026-84219

HIGHCVSS 7.5
View on NVD← Back to search
Description

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.

Timeline
Published:September 6th, 2026 7:16 AM
Last modified:September 6th, 2026 11:18 AM
CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)
CWE-79
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute