CVE-2026-84219

The Kirki WordPress plugin before 6.3.0 fails to consistently re-encode every spelling of the HTML entities it decodes when rendering, which allows unauthenticated users to store JavaScript in a WordPress comment (CWE-79). When anyone views a page that displays that comment, the injected script executes in the viewer's browser session, and if the theme builds its header or footer to show comments, the payload can fire on every page of the site. An attacker gains script execution in the session of any viewer, including logged-in administrators, potentially enabling administrative actions such as content or settings changes, though the high-complexity, user-interaction CVSS vector makes exploitation less reliable. All WordPress sites running a Kirki version prior to 6.3.0 that render comments are affected. There is no known public proof of concept, the plugin is not in CISA KEV, and EPSS is a low 0.2% (percentile 12), indicating no known exploitation to date.

What to do: Update Kirki to version 6.3.0 or later. Until patched, hold new comments for moderation and review recently posted comments for embedded scripts, since administrators are prime targets of the stored payload. Also check whether your theme bundles its own copy of Kirki and update the theme if it ships a fixed version.