UNKNOWN NVD

CVE-2026-84223

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access an

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

References

https://wpscan.com/vulnerability/02ed6d31-84f3-4723-8b49-ddb00c7db7d3/

Published: 2026-09-20 · Source: NVD · Feed updated: 2026-09-20

This unknown severity vulnerability was published on 2026-09-20 via NVD.

vulnfeed aggregates 14846 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.