Stored Cross-Site Scripting Vulnerability in Kirki Page Builder by WordPress
CVE-2026-14572

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Kirki – Freeform Page Builder, Website Builder & Customizer
Vendor
CVE Published:
15 October 2026

What is CVE-2026-14572?

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) attack. This vulnerability arises from inadequate input sanitization and output escaping in Page Builder Text Content. Authenticated attackers with specific capabilities granted by an administrator can exploit this flaw to inject arbitrary web scripts into the pages. These scripts execute whenever a user accesses the affected pages, posing significant risks to website security and user data.

Affected Version(s)

Kirki – Freeform Page Builder, Website Builder & Customizer 0 <= 6.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?reponame=&ne...
https://plugins.trac.wordpress.org/changeset/3636487/kirk...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pham Duc Anh
.