Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102173 · Microsoft / collected KEV context

cve-program · CVE-2026-102173

• https://www.wordfence.com/threat-intel/vulnerabilities/id/368001e9-3806-41d5-902e-0facf7fb31ff?source=cve
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/ExceptionalElements.php#L1184
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/ExceptionalElements.php#L1079
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/HelperFunctions.php#L1151
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L361
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L389
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/CompLibFormHandler.php#L76
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/ComponentLibrary/controller/ElementGenerator.php#L259
• https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L308
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3718900%40kirki%2Ftags%2F6.3.2&old=3697265%40kirki%2Ftags%2F6.3.1
• https://plugins.trac.wordpress.org/changeset/3718900/kirki/trunk/includes/Frontend/Preview/ExceptionalElements.php

No related operational record is retained in the current change model.