CVE-2026-57725 Themeum CVE debrief

Who should care

Users of Kirki plugin versions up to 6.0.11 should apply patches or mitigations. Affected operator, platform, vulnerability-management, and security-team impact should be considered. The vulnerability has a CVSS score of 7.1 and is considered High priority.

Technical summary

CVE-2026-57725 is a Stored XSS vulnerability in Kirki plugin versions up to 6.0.11. It is caused by improper neutralization of input during web page generation. Users of Kirki plugin versions up to 6.0.11 should apply patches or mitigations. The vulnerability has a CVSS score of 7.1 and is considered High priority.

Defensive priority

High priority due to CVSS score of 7.1 and potential for user exploitation.

Recommended defensive actions

• Apply patches or updates for Kirki plugin to version above 6.0.11
• Implement input validation and output encoding for user-generated content
• Monitor for suspicious activity and user behavior
• Consider compensating controls such as Web Application Firewalls
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from Patchstack and NVD suggests vulnerability exists; further verification needed. The CVE record was published on 2026-07-13T10:16:39.200Z and has not been modified since then. Affected product deployments should be confirmed to exist in managed environments. Review of official advisory or CVE record is required to validate affected scope, severity, and vendor guidance.

Official resources