CVE-2026-16974 is a stored cross-site scripting vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The flaw exists in the handling of the post_meta shortcode, where input is not properly sanitized or escaped before being rendered on pages. Authenticated attackers with Contributor-level privileges or above can exploit this to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to and including 6.2.0.

An attacker with Contributor-level or higher access can inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the privileges of the victim user. The vulnerability does not affect availability but impacts confidentiality and integrity of user data within the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the post_meta shortcode. Monitor for updates from the vendor to apply an official patch once released.