CVE-2026-84219: CWE-79 Cross-Site Scripting (XSS) in Kirki

CVE-2026-84219 is a CWE-79 Cross-Site Scripting vulnerability in the Kirki WordPress plugin versions before 6.3.0. The plugin fails to properly sanitize all variants of HTML entities during rendering, enabling unauthenticated attackers to store JavaScript code in comments. This malicious script executes in the session of any user viewing pages that display the compromised comments, including administrators. The vulnerability affects any page where comments are shown, including those that build the site header or footer, potentially leading to widespread script execution across the site.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user viewing affected pages, including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions performed with the victim's privileges. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

No official fix or patch is currently confirmed for this vulnerability. Users should upgrade to Kirki version 6.3.0 or later once available, as the vulnerability affects versions before 6.3.0. Until a patch is released, consider disabling comment rendering in headers or footers or applying custom sanitization to comments to mitigate risk. Monitor the vendor advisory for updates on remediation.