CVE-2026-66629

CVE-2026-66629 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Kirki plugin , affecting versions ≤ 6.2.3 (Patchstack lists ≤ 6.2.4). The vulnerability was discovered by daroo and carries a CVSS 3.1 score of 7.1 (HIGH) , with a changed scope and low impact on confid...