CVE-2026-54002 is a stored cross-site scripting vulnerability in the Kirby CMS affecting versions before 4.9.4 and 5.4.4. The flaw occurs because the sanitization functions Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), and file sanitizeContents() fail to correctly sanitize malicious markup injected as children of unknown HTML or XML tags. This improper neutralization of input during web page generation (CWE-79) allows stored XSS attacks via the writer or list fields or when these sanitization functions are called with untrusted input. The vulnerability is addressed by fixes in Kirby versions 4.9.4 and 5.4.4.

Successful exploitation allows attackers to inject stored malicious scripts into Kirby sites or plugins that use affected fields or sanitization functions. This can lead to execution of arbitrary scripts in the context of users' browsers, potentially resulting in session hijacking, defacement, or other malicious actions. The CVSS 4.0 score of 8.5 (high severity) reflects the network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

Upgrade affected Kirby installations to version 4.9.4 or 5.4.4 or later, where the vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.