This flaw allows an unauthenticated user to insert JavaScript code into comments because the plugin fails to neutralize decoded HTML entities. When a page that displays that comment, such as a stored header or footer, is loaded by any visitor—including administrators—the malicious script runs in the context of the user's browser. The vulnerability enables the attacker to steal authentication cookies, deface the site, or redirect users to malicious destinations, thereby compromising confidentiality, integrity, and availability of the site’s front‑end.

The issue affects the Kirki WordPress plugin versions 6.2.1 through 6.2.5. Any WordPress site using these plugin versions and rendering comments within page headers or footers is susceptible. No other vendors or product families are directly impacted.

The vulnerability is a stored, unauthenticated XSS that can affect all users who view a page containing the vulnerable comment. While a CVSS score is not published, the nature of XSS typically warrants a high severity assessment. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit this flaw by submitting a malicious comment from any IP address, making it highly accessible. Once the comment is stored, the script propagates to all visitors, including privileged accounts, and continues to affect every subsequent page rendering that comment.