An unauthenticated stored Cross-Site Scripting vulnerability in the Kirki WordPress plugin allows remote attackers to execute arbitrary JavaScript in the sessions of site administrators and visitors.

This is a stored Cross-Site Scripting (CWE-79) vulnerability where the plugin fails to properly neutralize HTML entities during rendering. An unauthenticated attacker can inject malicious JavaScript into comments, which subsequently executes within the browser session of any user viewing the affected page.

The exploitation of this vulnerability poses a significant risk to site integrity and administrative control. By executing malicious scripts in the context of an administrator, an attacker could potentially gain unauthorized access, modify site content, or redirect users to malicious domains. The CVSS score of 7.5 reflects the high impact on confidentiality, integrity, and availability, even considering the requirement for user interaction.

Immediate Action: Update the Kirki plugin to version 6.3.0 or later to apply the necessary security patches.

Proactive Monitoring: Review web server logs for unusual comment submissions or suspicious requests containing JavaScript tags, such as script or onerror.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to identify and block malicious script injection attempts at the edge.

Public Exploit Available: No (exploit_available is false).

Given the potential for administrative account compromise via stored XSS, administrators should prioritize updating the Kirki plugin immediately. Ensure all plugins are kept at their most recent versions and maintain regular backups to facilitate recovery in the event of a successful injection attack.