Kirby is an open‑source content management system. Prior to versions 4.9.4 and 5.4.4, sites using the writer field in any blueprint could embed a scripting link as the target of a link or email link in writer mark components. The link becomes clickable for the user who inputs it, allowing self‑cross‑site scripting in the Panel. The flaw is classified as CWE‑83 – Incorrect Input Validation, and the issue is resolved in versions 4.9.4 and 5.4.4.

The vulnerability affects all installations of Kirby CMS that use the writer field in any blueprint, specifically for versions released before 4.9.4 and 5.4.4. This includes sites hosted on GetKirby’s platform as well as self‑hosted deployments that have not applied the recent security releases.

The CVSS score of 7.4 indicates significant impact if exploited. The EPSS score is less than 1 %, reflecting a very low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is user interaction – an attacker can place a malicious scripting link into the writer field, and a victim who clicks the link within the Panel will trigger the payload. The attack requires the victim to be logged into the Panel, so an active session or compromised credentials are prerequisites.