CVE-2026-66629 Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Affected products and versions

Product	Affected versions	Fixed in
Kirki 6.2	earliest → 6.2.3	No fix stated

Other CVEs of Kirki

The 12 CVEs of Kirki →

CVE-2026-112348 Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token 6.9 Medium CVE-2026-112347 Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST… 7.2 High CVE-2026-42694 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki… 4.3 Medium CVE-2026-103065 Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality… 8.2 High