CVE-2026-102173
validatedZero produced an exploit or a check.description
Kirki – Freeform Page Builder, Website Builder & Customizer through version 6.3.1 can store attacker-controlled script content in registration metadata. An unauthenticated attacker may cause script execution for people who view an affected published page when public user registration is enabled and the page renders the relevant user collection.
mitigation
Disable public user registration and unpublish or reconfigure Kirki pages that render user collections from registration metadata. Update to a vendor-fixed release when one is published; no fixed version is recorded in the advisory.
outcome
Check only, differential: the check fires on the vulnerable build and is silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-07 05:30Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-102173
{ "etk_id": "ETK-2026-850", "cve_id": "CVE-2026-102173", "display_id": "CVE-2026-102173", "ghsa_id": null, "euvd_id": "EUVD-2026-94167", "status": "published", "anchor_state": "anchored", "title": "Stored cross-site scripting in Kirki WordPress plugin", "summary": "Kirki – Freeform Page Builder, Website Builder & Customizer through version 6.3.1 can store attacker-controlled script content in registration metadata. An unauthenticated attacker may cause script execution for people who view an affected published page when public user registration is enabled and the page renders the relevant user collection.", "mitigation": "Disable public user registration and unpublish or reconfigure Kirki pages that render user collections from registration metadata. Update to a vendor-fixed release when one is published; no fixed version is recorded in the advisory.", "vendor": "themeum", "product": "Kirki – Freeform Page Builder, Website Builder & Customizer", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 6.3.1" ], "ecosystem": null, "fixed_versions": [], "package_name": "Kirki – Freeform Page Builder, Website Builder & Customizer", "purl": null } ], "cwes": [ 79 ], "cvss_score": 7.2, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "epss_score": 0.0037, "epss_percentile": 0.2905, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": false, "pipeline_minutes": 34.26678375, "t0_at": "2026-10-07T05:30:40.929000+00:00", "signals": { "check": { "at": "2026-10-07T07:23:56.301689+00:00", "days": 0.07865014686342593, "is_lower_bound": false, "measured_at": "2026-10-07T05:30:40.929000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-07T05:30:40.929000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-07T05:30:40.929000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102173" } } }
published 2026-10-07 06:49Z
last change 2026-10-21 19:22Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.