CVE-2026-84223

Executive Summary

CVE-2026-84223 is a stored cross-site scripting (XSS) vulnerability in the Kirki WordPress plugin affecting all versions before 6.3.1. The plugin fails to sanitize SVG files that it makes uploadable site-wide, so a user with author-level privileges or higher can upload a malicious SVG containing embedded JavaScript. That file is then served from the site's own origin and executes JavaScript in the browser session of any user (visitor, subscriber, editor, or administrator) who opens it. The impact is session compromise, credential theft via DOM access, and potential privilege escalation against administrative users who view the poisoned SVG.

Technical Analysis

The vulnerability class is unrestricted file upload combined with stored cross-site scripting via SVG. The NVD description states that the Kirki WordPress plugin "before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide."

Two technical conditions combine to produce the flaw:

1. SVG as an active-content file type. SVG is an XML-based vector image format that supports <script> elements and inline event handlers (onload, onerror, etc.). Unlike raster formats (PNG, JPG, GIF), an SVG rendered directly by a browser is treated as an active document and any embedded JavaScript executes in the security context of the origin that served it. The NVD description explicitly calls out "a file containing JavaScript which is then served from the site's own origin."

2. Absent server-side sanitization. The plugin accepts SVG uploads and makes them available site-wide but does not strip dangerous elements, attributes, or namespaces from the file before storing and serving it. A properly hardened configuration would either disallow SVG entirely, strip <script>, <foreignObject>, and event-handler attributes, or serve uploads from a separate domain with Content-Disposition: attachment and a restrictive Content-Security-Policy. None of these controls are described as present in the vulnerable versions.

The attack surface is the WordPress media/upload pipeline as exposed through the Kirki plugin's SVG enablement. The plugin broadens the accepted MIME and extension set, which is a capability typically restricted to administrators via unfiltered_upload or explicit upload_mimes filtering. By making SVG uploadable site-wide, the plugin effectively lowers the trust boundary on the accepted file set and assigns the uploaded artifact the site's own origin — the exact origin against which WordPress nonces, admin cookies, and the REST API authenticate.

Because the file retains the site origin, the same-origin policy offers no protection: JavaScript inside the SVG can read DOM content, issue authenticated requests, and exfiltrate data to an attacker-controlled endpoint. The privilege requirement for the attacker is modest — "author-level access and above" — while the victims are unrestricted and can include administrators.

The description does not disclose the specific plugin function names, upload endpoints, or sanitization routines involved, and no parameter names or code identifiers are provided. Accordingly, this analysis stays at the mechanism level and does not attribute behavior to specific named functions inside the plugin.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code has been published for this CVE. The attack chain below is inferred from the vulnerability class (stored XSS via unsanitized SVG upload) and from the factual statements in the NVD description. It deliberately avoids inventing plugin-internal function names, endpoints, or parameters.

1. Reconnaissance and target identification. The attacker identifies WordPress sites running a Kirki version earlier than 6.3.1. Because Kirki is a widely used theme/plugin framework, fingerprinting is straightforward via the typical paths a WordPress installation exposes (/wp-content/plugins/kirki/, /wp-json/, and the standard readme/changelog files). Sites that expose author archives, comments, or other author-attributable content are the most useful targets because they reveal authoring accounts and confirm that the site permits contributor/author uploads.

2. Obtaining the required privilege. The advisory specifies that exploitation requires "author-level access and above." In a typical engagement or real-world attack, this is obtained via (a) a self-registration flow that grants the author role, (b) credential stuffing against a legitimately provisioned low-privilege account, or (c) any separate foothold that yields author capabilities. No vulnerability in Kirki itself grants this — the CVE presupposes the attacker already holds such an account.

3. Triggering the flaw and delivering the payload. The attacker uploads an SVG that carries JavaScript through the media upload mechanism the plugin has enabled. The payload class is the standard stored-XSS-in-SVG pattern: an SVG document containing an executable script or an event-handler attribute that fires when the document is rendered. The advisory notes the file is "served from the site's own origin," so once published or linked, any visitor to that URL executes the embedded script under the site origin. The attacker then induces a victim to open the uploaded file — via a link in a post, an email, a comment, or a direct URL shared to a target.

4. Post-exploitation impact. Because execution occurs at the site origin, the injected JavaScript can act as the victim in every sense that matters to WordPress: issuing authenticated requests to the admin REST API or admin-ajax, reading nonce-protected content from the DOM, hijacking the session cookie (if not HttpOnly) or performing authenticated actions on the victim's behalf, creating malicious admin accounts, altering posts or plugin/theme code, and exfiltrating data to an external endpoint. A victim administrator who merely opens the SVG can have their session silently abused, which converts a low-privilege author foothold into potential full site compromise.

Impact Assessment

This is a cross-privilege, session-integrity vulnerability. Rated conceptually, the most defensible CVSS subscores are:

• AV:N — exploitation is network-accessible through normal web browsing.
• AC:L — no special conditions are described beyond the plugin being present and SVG uploads enabled.
• PR:L — the attacker must hold author-level access or above, per the advisory.
• UI:R — a victim must open the uploaded SVG.
• S:C — execution occurs in the site origin, which is not the attacker's origin; scope changes.
• C:L / I:L / A:N — the attacker can read and modify content and take actions as the victim within the origin, but there is no direct integrity loss to the operating system or host from the XSS alone.

Business impact centers on site takeover risk. WordPress sites host customer-facing content; an admin who opens the poisoned SVG may have their account hijacked, allowing injection of spam, malware-redirect links, phishing content, or backdoors. Brand damage, SEO poisoning, and downstream compromise of the site's visitors all follow.

Blast radius is the entire WordPress installation and its visiting user base, because the payload is served from the site's origin and executes in every browsing context that renders it. Because no public exploit exists yet, blast radius is currently deterred only by the difficulty of obtaining author access — not by any mitigation inherent in the target. Standard WordPress hardening (disabling SVG uploads, DISALLOW_UNFILTERED_HTML, Content-Security-Policy) reduces exposure.

Detection Guidance

Detection must focus on SVG uploads, storage, and retrieval, and on suspicious JavaScript executing under the WordPress origin. The rules below are written at the vulnerability-class level; they use only general indicators (SVG files, upload endpoints, <script> inside image formats) and do not fabricate plugin-internal names.

Sigma Rule

title: WordPress SVG Upload Containing Script (Kirki CVE-2026-84223)
id: 5f3a9c2e-6b1d-4e77-9a10-8c2f7d4b3e11
status: experimental
description: Detects upload of SVG files containing JavaScript or event handlers to WordPress media endpoints, consistent with unsanitized SVG upload abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84223
author: Valters IT Threat Intel
logsource:
  category: webserver
  product: apache
  definition: HTTP access logs including POST requests to wp-admin/async-upload.php and POST bodies or WAF inspection of uploaded SVG content.
detection:
  selection_method:
    cs-method: POST
    cs-uri-query|contains:
      - 'async-upload.php'
      - 'media-new.php'
  selection_svg_submission:
    - 'Content-Type|contains: image/svg'
    - 'cs-uri-query|contains: .svg'
  selection_script_content:
    - 'cs-request-body|contains: <script'
    - 'cs-request-body|contains: onload='
    - 'cs-request-body|contains: javascript:'
    - 'cs-request-body|contains: <foreignObject'
  condition: selection_method and (selection_svg_submission or selection_script_content)
fields:
  - c-ip
  - cs-uri
  - cs-method
falsepositives:
  - Legitimate administrators uploading sanitized SVG assets
level: high

YARA Rule

rule CVE_2026_84223_Malicious_SVG_Upload
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects SVG files carrying executable JavaScript, consistent with CVE-2026-84223 (unsanitized SVG upload in Kirki WordPress plugin)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84223"
        date = "2026-01-01"
        severity = "high"

    strings:
        $svg_root = "<svg" ascii nocase
        $script_open = "<script" ascii nocase
        $script_close = "</script>" ascii nocase
        $onload = "onload=" ascii nocase
        $onerror = "onerror=" ascii nocase
        $onclick = "onclick=" ascii nocase
        $foreign = "<foreignObject" ascii nocase
        $js_uri = "javascript:" ascii nocase
        $js_proto = "http" ascii nocase

    condition:
        $svg_root and 1 of ($script_open, $onload, $onerror, $onclick, $foreign, $js_uri)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84223 Possible Malicious SVG Upload to WordPress (Kirki)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"async-upload.php"; http.uri; content:".svg"; http.header; content:"image/svg"; http.request_body; content:"<script"; nocase; http.request_body; content:"</script>"; nocase; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84223; classtype:web-application-attack; sid:202684223; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ file where event.action == "creation" and file.extension == "svg" ]
  [ http where http.request.method == "POST" and
      (http.request.body.content : "*<script*" or
       http.request.body.content : "*onload=*" or
       http.request.body.content : "*javascript:*") and
      http.request.body.content : "*<svg*" ]

Splunk SPL Query

index=web sourcetype=access_combined (uri="*async-upload.php*" OR uri="*.svg*") method=POST
| rex field=uri "(?<upload_path>.*\.svg)"
| where isnotnull(upload_path) OR match(_raw, "(?i)<script|onload=|javascript:|<foreignObject")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="web,wordpress,attack,">
  <rule id="100842" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.svg$</field>
    <description>CVE-2026-84223: Possible malicious SVG upload in WordPress (Kirki plugin)</description>
    <group>web_attack,svg_upload,xss,</group>
  </rule>
  <rule id="100843" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>async-upload\.php</match>
    <match>image/svg</match>
    <description>CVE-2026-84223: SVG upload to WordPress media endpoint</description>
    <group>web_attack,svg_upload,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory in the NVD description identifies 6.3.1 as the fixed release, but no vendor advisory, source diff, or CVE record has been corroborated by the tracked patch feeds at the time of writing. Treat 6.3.1 as the vendor-asserted fix and verify against the official repository before relying on it.

1) Immediate mitigations (apply before patch validation completes):

• Disable SVG uploads entirely (define('ALLOW_UNFILTERED_UPLOADS', false); and remove image/svg+xml from upload_mimes via a mu-plugin) until the plugin is upgraded.
• Serve all uploads from a separate origin or subdomain with Content-Disposition: attachment and a strict Content-Security-Policy that forbids inline script and blocks script-src 'none' on user-uploaded content.
• Enforce X-Content-Type-Options: nosniff and Content-Security-Policy with sandbox on the uploads directory.
• Restrict author-level upload privileges; if the site does not need author uploads, revoke upload_files from the author role.
• Add a WAF rule blocking POST bodies to media endpoints that contain <script inside an <svg root.
• Review existing uploads for SVG files and quarantine or sanitize any that contain script elements or event-handler attributes.

2) Patch/upgrade steps:

• Verify the latest available Kirki release in the WordPress.org plugin repository or the vendor's canonical distribution point.
• Upgrade to 6.3.1 or the latest stable release. Test in staging first because theme/plugin integrations can break.
• Re-run the SVG upload test in staging to confirm the sanitization fix is effective.
• Re-scan the uploads directory post-upgrade and remove any legacy malicious SVGs.
• Confirm the remediation via the vendor's changelog or CVE record once available; the 0/4 confidence rating means independent validation is required.

3) Long-term hardening:

• Adopt a default-deny upload policy: only explicitly approved file types may be stored.
• Sanitize on ingest (server-side, e.g., via a library that strips active content) rather than on output.
• Separate content origins from the application origin (sandboxed user-content subdomain).
• Apply least-privilege roles: authors should not be able to upload active-content formats.
• Monitor for new advisories on Kirki and on the broader WordPress plugin ecosystem; re-run the detection rules above on a schedule.

References

1. NVD — CVE-2026-84223: https://nvd.nist.gov/vuln/detail/CVE-2026-84223
2. Vendor / WordPress plugin repository — Kirki (6.3.1 changelog and download): https://wordpress.org/plugins/kirki/
3. CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA KEV catalog — check for future inclusion: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and exploitation status: No public proof-of-concept, no Nuclei template, no exploit code, and no CISA KEV listing are associated with CVE-2026-84223 as of this writing. No threat-actor campaign has been attributed to this CVE. The EPSS score has not been published by FIRST.org; no EPSS value should be inferred. All detection content above targets the vulnerability class and should be tuned to reduce site-specific false positives.