The Kirki WordPress plugin contains a flaw that allows unauthenticated visitors to trigger the execution of shortcodes that are stored in comments. Because the plugin renders comments without enforcing moderation status and does not strip or escape shortcode tags, a comment containing a shortcode can be executed on page load. In addition, the plugin displays all comments regardless of moderation, which can reveal private custom fields of the page being viewed.

Any WordPress site that has the Kirki plugin installed at a version prior to 6.3.2 is affected. Site owners should verify the installed plugin version and update to 6.3.2 or later, which blocks shortcode execution from comments and respects comment moderation.

The CVSS base score of 4.8 indicates a medium severity. The EPSS score of < 1% reflects a very low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker can post a comment with a malicious shortcode or any shortcode registered on the site; when the page renders, the shortcode will be executed, and private custom fields may be exposed. The attack vector is unauthenticated and relies only on comment submission and lack of moderation controls.