CVE Catalog
CVE-2026-66629
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk0.24%
15th percentile - higher than 15% of all known CVEs
Summary
Unauthenticated XSS vulnerability in Kirki versions up to 6.2.3. An attacker can inject malicious scripts that execute in the victim's browser.
Risk Assessment
Risk of data theft, session hijacking, or unauthorized actions in the context of a logged-in user.
Recommendation
Update Kirki to a version newer than 6.2.3 if a patch is available.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.