Kirki 6.0.0 – 6.3.0 – Author+ Stored XSS via Unsanitized SVG Upload

Kirki does not sanitize uploaded SVG files while making them uploadable site-wide. This allows users with author-level access and above to upload an SVG containing JavaScript, which is then served from the site's own origin and executes in the session of anyone who opens it.

An authenticated attacker with author-level access can achieve stored cross-site scripting. The malicious script runs in the victim's authenticated session, so if a higher-privileged user such as an administrator opens the file, the attacker could perform actions on their behalf, potentially leading to privilege escalation and full site compromise.