CVE-2026-17037

CVE-2026-17037 is a stored cross-site scripting (XSS, CWE-79) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, caused by insufficient input sanitization and output escaping of the 'comment' parameter. An unauthenticated attacker can submit a crafted 'comment' value that the plugin stores and later outputs without proper escaping, so the injected web script executes in the browser of any user who loads the affected page. Successful exploitation lets the attacker run arbitrary JavaScript in victims' browsers — for example stealing session cookies or performing actions in the context of logged-in users, including administrators — and the CVSS 3.1 score of 7.2 (High) with a changed scope reflects that users beyond the vulnerable component are impacted. All versions of the plugin up to and including 6.2.0 are affected on any WordPress site where the plugin is active. As of this analysis there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the issue is not in CISA's KEV; the CVE was assigned by Wordfence, the WordPress ecosystem CNA.

What to do: Update the plugin to a patched release newer than 6.2.0 as soon as one is available, since all versions through 6.2.0 are affected. Until then, deploy a WAF or virtual-patching rule that strips HTML/script tags and event-handler attributes from 'comment' parameters, and audit recently saved content and comments for injected script payloads. Sites that do not rely on the plugin's form/comment functionality can deactivate the plugin as an interim mitigation.