CVE-2026-102173: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themeum Kirki – Freeform Page Builder, Website Builder & Customizer

CVE-2026-102173 describes a stored cross-site scripting vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The flaw exists due to improper neutralization of input in the ExceptionalElements::image_element() function, which directly concatenates user registration metadata into an <img src="..."> attribute without proper escaping. This allows unauthenticated attackers to inject malicious scripts that execute when a user accesses a page rendering a Kirki users collection bound to one of nine registration meta fields. Successful exploitation requires that public user registration is enabled and a page with a kirki-register element is published, which outputs the necessary element nonce in the public markup.

An attacker can inject and execute arbitrary JavaScript in the context of users visiting affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. The vulnerability is exploitable without authentication but requires specific plugin configuration (public user registration enabled and a kirki-register element on a published page). The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling public user registration or removing kirki-register elements from published pages to mitigate exposure. Monitoring vendor channels for updates and applying patches promptly once released is recommended.