CVE-2026-17037 is a stored cross-site scripting vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. The flaw exists in all versions up to and including 6.2.0, where the 'comment' parameter is not properly sanitized or escaped, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other client-side impacts.

An attacker can inject persistent malicious scripts via the 'comment' parameter without authentication. When other users access the compromised pages, the injected scripts execute in their browsers, potentially leading to information disclosure or session compromise. The CVSS score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting the vulnerable plugin or applying custom input sanitization and output escaping as a temporary mitigation.