All vulnerabilities
CVE-2026-74992
Medium
CVSS 6.8
Stored XSS via font archive upload in Kirki
| Vendor | Themeum |
|---|---|
| Product | Kirki |
| Affected versions | < 6.2.3 |
| Weakness | CWE-79 |
| Reported | 2026-08-18 |
| Disclosed | 2026-08-18 |
| Status | Published |
Discovered and responsibly disclosed CVE-2026-74992, an Editor+ Stored XSS vulnerability in the "Kirki" plugin. The plugin did not validate the files inside uploaded font archives (ZIP) and did not remove unwanted files after extraction, allowing arbitrary files to be uploaded to a web-accessible directory — leading to Stored XSS and, on some server configurations, Remote Code Execution (RCE). Fixed in version 6.2.3 (CVSS 6.8, CWE-79).
Related disclosures
Medium
Kirki 6.0.0 – 6.3.0 – Author+ Stored XSS via Unsanitized SVG Upload
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
Medium
Kirki Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
View all