{"schema":"threatline.record/2","record":{"id":"CVE-2026-102173","aliases":[],"summary":"Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata","details":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src=\"…\">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.","categories":["Unclassified"],"product":"Kirki – Freeform Page Builder, Website Builder & Customizer","vendor":"themeum","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102173","source_modified_at":"2026-10-07T17:05:30.285Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Kirki – Freeform Page Builder, Website Builder & Customizer","vendor":"themeum","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.3.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00366,"percentile":0.29305,"score_date":"2026-10-23"},"published_at":"2026-10-07T05:30:40.929Z","modified_at":"2026-10-07T17:05:30.285Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102173","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T17:05:30.285Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102173","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368001e9-3806-41d5-902e-0facf7fb31ff?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/ExceptionalElements.php#L1184"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/ExceptionalElements.php#L1079"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/HelperFunctions.php#L1151"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L361"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L389"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L76"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/ElementGenerator.php#L259"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L308"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3718900%40kirki%2Ftags%2F6.3.2&old=3697265%40kirki%2Ftags%2F6.3.1"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3718900/kirki/trunk/includes/Frontend/Preview/ExceptionalElements.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-07T16:08:31.005389Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T17:05:30.285Z","content_hash":"f09c2c795d495136a513e20b1f74361eeb6c8f49d9f64b3a32b1278d3e5e7fb9"}}