CVE-2026-74992 Medium CVSS 6.8

Stored XSS via font archive upload in Kirki

Vendor	Themeum
Product	Kirki
Affected versions	< 6.2.3
Weakness	CWE-79
Reported	2026-08-18
Disclosed	2026-08-18
Status	Published

Discovered and responsibly disclosed CVE-2026-74992, an Editor+ Stored XSS vulnerability in the "Kirki" plugin. The plugin did not validate the files inside uploaded font archives (ZIP) and did not remove unwanted files after extraction, allowing arbitrary files to be uploaded to a web-accessible directory — leading to Stored XSS and, on some server configurations, Remote Code Execution (RCE). Fixed in version 6.2.3 (CVSS 6.8, CWE-79).

Advisory

Related disclosures

Medium Kirki 6.0.0 – 6.3.0 – Author+ Stored XSS via Unsanitized SVG Upload CVE-2026-84223 High Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient CVE-2026-104641 Medium Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass CVE-2026-81813 Low Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet CVE-2026-106095

View all