Kirki (Unknown) - vulnerabilities (CVEs)
15 CVEs, 2 in the last 30 days, 1 known versions, newest CVE from 2026-10-09. Vendor: Unknown.
CVEs of Kirki
- CVE-2026-84224 - CVSS 4.1 (medium), 2026-10-09: The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above…
- CVE-2026-84220 - CVSS 4.8 (medium), 2026-10-09: The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments…
- CVE-2026-84223 - CVSS 6.8 (medium), 2026-09-20: The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access…
- CVE-2026-84222 - CVSS 5.3 (medium), 2026-09-09: The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content,…
- CVE-2026-84219 - CVSS 7.5 (high), 2026-09-06: The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to…
- CVE-2026-84225 - CVSS 2.2 (low), 2026-09-05: The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom…
- CVE-2026-84221 - CVSS 6.8 (medium), 2026-09-05: The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and…
- CVE-2026-77754 - CVSS 5.3 (medium), 2026-08-26: The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated…
- CVE-2026-74992 - CVSS 6.8 (medium), 2026-08-20: The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove…
- CVE-2026-16747 - CVSS 6.5 (medium), 2026-08-12: The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through…
- CVE-2026-12720 - CVSS 7.5 (high), 2026-07-31: The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store,…
- CVE-2026-12721 - CVSS 8.6 (high), 2026-07-31: The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing…
- CVE-2026-13147 - CVSS 9.1 (critical), 2026-07-20: The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make…
- CVE-2026-12724 - CVSS 4.3 (medium), 2026-07-20: The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the…
- CVE-2026-12723 - CVSS 5.3 (medium), 2026-07-20: The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the…
