CVE-2026-16974: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-16974 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0. The flaw exists in the post_meta shortcode handler due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on August 11, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The vulnerability resides in the post_meta shortcode implementation within the Kirki plugin, where user-supplied input is neither properly sanitized on input nor escaped on output before being rendered in the browser. An authenticated attacker with at minimum Contributor-level WordPress access can craft a malicious shortcode payload and embed it in a post or page; the script executes in the context of any user's browser when they visit the affected page. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors — including administrators. This can lead to session hijacking, credential theft, malware distribution to site visitors, unauthorized administrative actions (such as privilege escalation or backdoor installation), and defacement of site content. The scope change in the CVSS score reflects that the injected script affects users beyond the attacker's own session (GitHub Advisory, Wordfence).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Kirki – Freeform Page Builder plugin at version 6.2.0 or earlier, using tools like WPScan or by inspecting publicly visible plugin metadata.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create a post or page containing a post_meta shortcode with an embedded JavaScript payload, e.g., [kirki_post_meta key="<script>malicious_code_here</script>"] or equivalent unsanitized parameter.
4. Publish or submit content: Submit the post for review or publish it (depending on role permissions), embedding the malicious shortcode in the page content.
5. Trigger execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session cookie theft, credential harvesting, or further exploitation (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or REST API endpoints containing suspicious shortcode content with script tags or encoded JavaScript in the post_meta shortcode parameter.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags or JavaScript event handlers within shortcode attributes.
• Network: Outbound requests from visitor browsers to unknown external domains (e.g., for cookie exfiltration or payload delivery) originating from pages containing the Kirki post_meta shortcode.
• Application: WordPress admin audit logs (if enabled) showing Contributor-level users creating or editing pages with unusual shortcode content shortly before reports of anomalous behavior from site visitors.

Update the Kirki – Freeform Page Builder, Website Builder & Customizer plugin to a version newer than 6.2.0 immediately; a patch was made available on August 11, 2026 (changeset 3636487 in the WordPress plugin repository). As a temporary workaround, restrict Contributor-level access to only fully trusted users, or disable the plugin until the update can be applied. Implementing Content Security Policy (CSP) headers can reduce the impact of any successful XSS injection. Review existing published posts and pages for suspicious post_meta shortcode content that may have already been injected (GitHub Advisory, WordPress Changeset).

The vulnerability was reported and assigned by Wordfence, which published a threat intelligence entry for it on August 11, 2026. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time (Wordfence).