CVE-2026-74992 - Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload · CoreCVE

Back Back to CVE browser

MEDIUM

Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload

Published Aug 20, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.43%

Description

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.

Affected products

Vendor n/a Product Kirki Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <6.2.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Kirki

unaffected

Version	Status	Constraints
0	affected	<6.2.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://wpscan.com/vulnerability/ba981818-f4a0-444a-bf6a-e4caacc9d1aa/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/ba981818-f4a0-444a-bf6a-e4caacc9d1aa/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Aug 20, 2026

Updated Aug 20, 2026

Reserved Aug 17, 2026

Link CVE-2026-74992

CISA Vulnrichment

Updated Aug 20, 2026

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-74992

Severity n/a

Public date n/a

Links CVE-2026-74992