Kirby is an open‑source content management system. Prior to versions 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross‑site scripting in the Panel. This flaw is classified as CWE‑83 – Incorrect Input Validation, and the issue was fixed in versions 4.9.4 and 5.4.4.

The vulnerability affects all installations of Kirby CMS that use the writer field in any blueprint, specifically for versions released before 4.9.4 and 5.4.4. This includes sites hosted on GetKirby’s platform as well as self‑hosted deployments that have not applied the recent security releases.

The CVSS score of 7.4 indicates significant impact if exploited. The EPSS score is less than 1 %, reflecting a very low but non‑zero likelihood of exploitation. The flaw is not in the CISA KEV catalog. The likely attack vector is user interaction – an attacker can place a malicious scripting link into the writer field, and a victim who clicks the link within the Panel will trigger the payload. The attack requires the victim to be logged into the Panel, so an active session or compromised credentials are prerequisites.