What is CVE-2026-74992?

CVE-2026-74992 is a medium-severity vulnerability in Kirki, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2026-08-20.

How severe is CVE-2026-74992?

Medium severity. CVSS v3 base score is 6.8 out of 10.

XSS in Kirki

CVE-2026-74992

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H.

Affected products

Unknown Kirki

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-74992?: CVE-2026-74992 is a medium-severity vulnerability in Kirki, classified under Cross-site Scripting. CVSS score: 6.8/10. Published 2026-08-20.
How severe is CVE-2026-74992?: Medium severity. CVSS v3 base score is 6.8 out of 10.