The vulnerability lies in the post_meta shortcode of the Kirki plugin, which fails to sanitize or escape user‑supplied input. As a result, authenticated users who can add or edit content using this shortcode may insert malicious scripts. Those scripts execute in the context of any visitor who loads the affected page, allowing attackers to hijack sessions, steal credentials, or perform other client‑side attacks. The weakness matches the commonly known web injection flaw categorized as CWE‑79.

The issue affects the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin for all released versions up to and including 6.2.0. Anyone running a vulnerable installation of this plugin is at risk, regardless of the size or age of the site, as long as a Contributor‑level or higher WordPress role is present.

The CVSS score of 6.4 places the vulnerability in the Medium severity range. With no EPSS data available, the historical exploitation frequency is unknown, but the fact that it requires only Contributor‑level access—which is common on collaborative sites—makes it an attractive target for attackers. The vulnerability is not yet listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed. The likely attack vector involves a contributor inserting a malicious snippet via the post_meta shortcode, which then silently propagates to all page viewers.