Kirki SVG uploads can run script from the site origin
Kirki enables SVG uploads site-wide without sanitizing the files. An Author or higher role can upload an SVG containing script that executes in the site's origin when a visitor, including an administrator, opens it. File viewing is required; the export does not disclose the upload handler or a separate account-takeover sequence. Authoritative affected range: 6.0.0 to < 6.3.1. Confirmed remediation: 6.3.1.
- Component
- Kirki
- Plugin slug
kirki- Affected
- 6.0.0 to < 6.3.1
- Safe version
6.3.1- Published
- Sep 20, 2026
This CVE was published Sep 20, 2026 and is one of 42 known issues for this plugin.
Update, patch or deactivate.
Update to the applicable fixed release identified in the authoritative export: 6.3.1. Disable untrusted SVG uploads until updated. Use a robust SVG sanitizer or reject active SVG content, and avoid serving untrusted active documents from the application origin. Remove already uploaded malicious files.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H