Kirby is an open‑source content management system. Before versions 4.9.4 and 5.4.4, sites and plugins that use writer or list fields or that explicitly invoke Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input were vulnerable to stored cross‑site scripting. Malicious markup injected as children of an unknown HTML or XML tag bypassed the sanitization routine and was stored in the database, meaning any subsequent rendering to other users would execute arbitrary JavaScript. The flaw is a classic injection vulnerability (CWE‑79) and also involves improper sanitization of unknown tags (CWE‑87).

The vulnerability affects the open‑source Kirby CMS from the getkirby vendor. All projects built on Kirby v4 prior to 4.9.4 and Kirby v5 prior to 5.4.4 that use the writer or list fields, or that explicitly call Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input, are susceptible. It also applies to any plugin that operates on similar sanitization functions without applying the latest updates. Affected versions are explicitly mentioned as 4.9.4 and 5.4.4, which are the first secure releases.

With a CVSS score of 8.5 the vulnerability is considered high‑risk and would be exploitable when an attacker can submit or otherwise supply untrusted input to the identified fields or functions. Based on the description, it is inferred that the attack is performed via the web interface, typically by submitting crafted data that later becomes stored and rendered to other users. The EPSS score of < 1% indicates a very low probability of exploitation currently, but the lack of listing in CISA’s KEV catalog does not diminish its significance. The exploit requires user interaction to inject the payload, but once present it can affect all users browsing the compromised site. The vulnerability is more concerning in multi‑tenant or public sites where the attacker can influence a larger audience.