CVE-2026-14572

Executive Summary

CVE-2026-14572 is a stored cross-site scripting (XSS) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0. The flaw stems from insufficient input sanitization and output escaping on Page Builder text content. An authenticated attacker who holds the kirki_content_access capability — a permission granted by an administrator — can inject arbitrary web scripts into pages that execute when any visitor loads the affected page. Because the CVSS vector indicates scope change (S:C) and low confidentiality/integrity impact, successful exploitation can compromise content integrity and potentially affect the broader site context.

Technical Analysis

The vulnerability class is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically the stored/persistent subtype. The NVD description states the issue arises "via Page Builder Text Content" and is caused by "insufficient input sanitization and output escaping."

Mechanism at the vulnerability-class level: A user-controlled value entered into the page builder's text content field is stored server-side (typically in WordPress post metadata or custom tables) and later rendered into an HTML page without adequate escaping. Because the stored payload is emitted into the response body during page generation, script content survives persistence and executes in the browser of any subsequent viewer. This is the defining property of stored XSS, as opposed to reflected or DOM-based variants.

Triggering condition: The attacker must be authenticated and must possess the kirki_content_access capability. Per the description, this capability is granted by an administrator, which means the attack is a privileged-insider or post-account-compromise scenario rather than an unauthenticated one. That framing is consistent with the CVSS vector AV:N/AC:L/PR:L/UI:N, which models a network-reachable, low-complexity issue requiring low privileges with no user interaction for the victim (the victim merely loads the page).

Input/output boundary: The failing boundary is between the stored page-builder text field (input) and the rendered front-end page (output). "Insufficient input sanitization" implies the plugin does not strip or encode dangerous markup on ingest, and "insufficient output escaping" implies the renderer does not contextually encode the value on egress. Either control alone, correctly applied, would neutralize the flaw; the description indicates both are inadequate.

Scope change (S:C): The scope metric is Changed, indicating that a successful exploit can affect resources beyond the vulnerable component's own security authority. In a WordPress context this is consistent with injected script executing in the security context of the site's domain and potentially interacting with broader origin-scoped resources (cookies, session state, adjacent admin functions rendered on the same origin).

Note on technical specificity: The NVD text does not disclose the specific function, hook, option key, REST route, or parameter name involved in the mishandling. No such identifiers are asserted in this report. The analysis is confined to the vulnerability class and the attack surface explicitly named (Page Builder Text Content) and the capability explicitly named (kirki_content_access). Deeper code-level claims would require source review of the plugin, which is outside the supplied data.

Absence of exploit maturity signals: No public PoC, no exploit code, and no Nuclei template are associated with this CVE in the provided dataset. CISA KEV does not list the CVE. EPSS has not yet scored the vulnerability, so no probability estimate is available and none is inferred here.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description. It is written at the vulnerability-class level because no public PoC or implementation details are available; specific internal function names, endpoints, and parameters cannot be asserted from the supplied data.

1. Reconnaissance/target identification. An adversary enumerates WordPress sites running the Kirki plugin at version 6.2.0 or earlier. Public HTML fingerprints such as plugin asset paths (/wp-content/plugins/kirki...) and page markup referencing the page builder aid identification. The adversary prioritizes sites where they already control, or can obtain, an account with the kirki_content_access capability.

2. Precondition establishment. The attacker acquires the kirki_content_access capability. Per the description this capability is granted by an administrator, so the realistic paths are: a legitimate but malicious or coerced low-privilege user (insider), a compromised account belonging to such a user, or a separate privilege-escalation chain that results in the capability being assigned. Without this capability, the injection primitive is not reachable.

3. Triggering the flaw class. Using the page builder, the attacker supplies crafted text content into the "Page Builder Text Content" field. Because sanitization on input is insufficient, the payload is persisted. The payload is not executed at injection time; it is stored.

4. Execution. Any user — including unauthenticated visitors, other authenticated users, or an administrator — who accesses the page containing the injected content causes the stored script to be rendered and executed by their browser. The CVSS vector's UI:N indicates the victim does not need to perform any action beyond loading the page.

5. Post-exploitation impact. Executed script runs in the origin of the affected site and, given the scope change, may reach beyond the vulnerable component itself. Realistic consequences for stored XSS in this context include session/session-token theft, unauthorized actions performed as the viewing user, content defacement, redirection to attacker-controlled infrastructure, credential-harvesting overlays, and persistence by re-injecting payloads through the same builder. Confidentiality and integrity impacts are both rated Low in the CVSS vector, and no availability impact is stated.

Caveat: No public PoC is available; the attack chain above is inferred from the vulnerability class and the preconditions stated in the NVD description. No specific payload strings, code patterns, or hypothetical function names are assumed.

Impact Assessment

CVSS v3.1 base score is 6.4 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. Interpretation by subscore:

• Attack Vector (AV:N): Exploitable over the network; no physical or adjacent access required.
• Attack Complexity (AC:L): No special conditions, race windows, or non-default configuration are described.
• Privileges Required (PR:L): The attacker needs a low-privilege authenticated account that has been granted kirki_content_access. This is the primary limiting factor on real-world exploitation.
• User Interaction (UI:N): The victim needs only to load the injected page; no clicking or confirming is required.
• Scope (S:C): Impact may extend beyond the vulnerable plugin's security authority, which is consistent with stored script executing under the site's origin and reaching origin-scoped resources.
• Confidentiality (C:L) and Integrity (I:L): Both Low. Integrity impact is the more directly demonstrated outcome (arbitrary script injection and content manipulation); confidentiality impact follows from script access to page context.
• Availability (A:N): No availability impact stated.

Business impact: Affected assets are WordPress sites that run the Kirki Freeform Page Builder plugin at version 6.2.0 or earlier and that have granted kirki_content_access to at least one account beyond strict trust. Because the payload persists in page content, the compromise is durable rather than transient: every visitor to the affected page is exposed until the injected content is removed. For public-facing sites, this can mean persistent malicious redirects, SEO poisoning, drive-by content, or credential-harvesting overlays delivered to an unbounded visitor population. For sites with authenticated areas, injected script may act against logged-in users within the site origin. The insider dimension (kirki_content_access granted by an administrator) means blast radius is heavily determined by how liberally that capability has been delegated. An organization that grants the capability broadly should treat every grant as a potential injection point.

Blast radius considerations: A single compromised low-privilege builder user can affect all visitors of any page they can edit. If the injected content is placed on a high-traffic template or homepage, exposure scales with site traffic. Because no fixed version is published and the patch status is only claimed by a single source (NVD), the exposed population currently includes all installs at 6.2.0 and below.

Detection Guidance

Detection is challenging because this is stored XSS: the injection occurs through legitimate authenticated page-builder workflows, and the payload is delivered through normal page loads. Detection therefore combines content-inspection at rest, log correlation of privileged content changes, and response-body inspection at the network edge.

Sigma Rule

title: WordPress Kirki Page Builder Potential Stored XSS Payload in Content Updates
id: 8f2c1a44-5b7e-4d9a-9c31-7a0e6b2d1452
status: experimental
description: Detects WordPress content update requests containing script-like markup that may indicate stored XSS injection via the Kirki page builder text content field (CVE-2026-14572).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14572
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.79
logsource:
  category: webserver
  product: apache
  service: http
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_path:
    cs-uri-stem|contains:
      - '/wp-json/'
      - '/wp-admin/admin-ajax.php'
      - '/wp-admin/post.php'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<svg'
      - 'document.cookie'
  condition: selection_method and selection_path and selection_payload
falsepositives:
  - Legitimate administrators pasting code samples into documentation pages
  - Security scanners and WAF test traffic
level: medium

YARA Rule

rule WordPress_Kirki_Stored_XSS_CVE_2026_14572
{
    meta:
        description = "Detects script-injection indicators in stored WordPress page builder content associated with CVE-2026-14572 (Kirki plugin stored XSS)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14572"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "<script" nocase
        $b = "javascript:" nocase
        $c = "onerror=" nocase
        $d = "onload=" nocase
        $e = "onmouseover=" nocase
        $f = "<svg" nocase
        $g = "document.cookie" nocase
        $h = "kirki" nocase
        $i = "kirki_content_access" nocase

    condition:
        uint32be(0) == 0x504B0304 or
        (
            any of ($a, $b, $c, $d, $e, $f, $g) and
            any of ($h, $i)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14572 WordPress Kirki Page Builder Stored XSS Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wp-json/"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"kirki"; nocase; reference:cve,2026-14572; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-14572; classtype:web-application-attack; sid:2026145701; rev:1;)

alert http any any -> any any (msg:"CVE-2026-14572 WordPress Kirki Stored XSS Payload in Content Update"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/"; nocase; http.request_body; content:"onerror="; nocase; http.request_body; content:"kirki_content_access"; nocase; reference:cve,2026-14572; classtype:web-application-attack; sid:2026145702; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.category == "process" and
     process.name : "php*" and
     process.args : "*kirki*"]
  [network where event.category == "network" and
     network.protocol == "http" and
     http.request.method == "POST" and
     http.request.body.content : ("*<script*" or "*onerror=*" or "*javascript:*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval payload = lower(coalesce(uri_query, "") . " " . coalesce(form_data_body, ""))
| where (match(uri_path, "(?i)/wp-json/|/wp-admin/|admin-ajax\.php"))
    AND (match(payload, "<script|javascript:|onerror=|onload=|onmouseover=|<svg"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths
        by src_ip, status
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,web,xss,">
  <rule id="2026145" level="7">
    <if_sid>31100</if_sid>
    <match>POST</match>
    <regex>wp-json|wp-admin|admin-ajax\.php</regex>
    <description>CVE-2026-14572: WordPress Kirki page builder content update observed</description>
    <group>cve_2026_14572,</group>
  </rule>

  <rule id="2026146" level="10">
    <if_sid>2026145</if_sid>
    <regex>&lt;script|javascript:|onerror=|onload=|&lt;svg</regex>
    <description>CVE-2026-14572: Potential stored XSS payload detected in Kirki page builder request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_14572,</group>
  </rule>
</group>

Operational note: Because the payload is stored, network-layer detections on the write request (as above) should be complemented by periodic content scans of post metadata and rendered pages for script tags in builder-managed fields, and by alerting on any grant of the kirki_content_access capability via user-role audit logging.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, NVD, indicates a patch; this has not been independently confirmed and no specific fixed version is published in the supplied data).

1. Immediate mitigations

• Audit and restrict the kirki_content_access capability. Revoke it from any account that does not absolutely require page-building privileges. Because exploitation requires this capability, minimizing its distribution directly reduces exposure.
• Enable a web application firewall and deploy rules that inspect page-builder and content-update request bodies for script-like markup and dangerous event-handler attributes.
• Sweep existing page content and stored page-builder fields for injected script markup and remove anything suspicious; because the vulnerability is stored, prior compromises persist after any code fix.
• Where the plugin is not business-critical, consider temporarily deactivating it on any site that cannot immediately restrict kirki_content_access.

2. Patch/upgrade steps

• Monitor the plugin's official release channel for a version later than 6.2.0 and apply it as soon as it is published and the fix is verified. The asserted patch is not yet tied to a confirmed version in the supplied data, so do not assume that a specific numbered release is verified safe until release notes explicitly reference this CVE.
• After upgrading, re-scan stored content for residual injected scripts, since upgrading removes the injection path but does not clean previously stored payloads.
• Validate the fix by attempting to store script-like content in the page builder as a low-privilege user holding kirki_content_access and confirming it is neutralized on output.

3. Long-term hardening

• Apply least privilege to all WordPress capabilities, with particular scrutiny on content-editing and builder capabilities; treat capability grants as security-relevant changes and log them.
• Enforce contextual output escaping in any custom or third-party rendering path, and review third-party builder plugins for equivalent stored XSS patterns.
• Maintain an inventory of installed plugins and their versions, with alerting on the presence of known-affected releases such as a plugin at 6.2.0 or below.
• Enable WordPress auto-updates for security releases where operationally acceptable, and monitor the NVD entry and the vendor's release notes for patch confirmation.

References

• NVD — CVE-2026-14572: https://nvd.nist.gov/vuln/detail/CVE-2026-14572
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-14572 not listed; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (CVE-2026-14572 not yet scored at time of writing): https://www.first.org/epss/

Exploit-in-the-wild and threat-actor assessment: No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing are associated with CVE-2026-14572 in the available data, and EPSS has not yet produced a score. There is no evidence of active exploitation or named threat-actor campaigns. Given the required privileges (kirki_content_access) and the storage-based delivery, the realistic abuse pattern is post-compromise or insider rather than opportunistic mass exploitation, but this assessment is inferred from the vulnerability class and preconditions, not from observed campaign data.