CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
Editors can upload malicious archives to trigger Stored XSS and potential remote code execution in the Kirki WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-74992?
CVE-2026-74992 is a medium-severity cross-site scripting vulnerability in Unknown Kirki, published on 20 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
Weakness: CWE-79
Which versions are affected by CVE-2026-74992?
How do I fix CVE-2026-74992?
No fix has been published for CVE-2026-74992 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-74992 being exploited?
There is no known exploitation of CVE-2026-74992 in the wild and no public exploit code.
Sources
Also known as GHSA-7grj-4mf9-j4px.