8.6
High
CVE-2026-12721 The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before…
Description
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki 6.0 | earliest → < 6.0.13 | 6.0.13 |
Other CVEs of Kirki
The 15 CVEs of Kirki →
CVE-2026-84220
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
4.8
Medium
CVE-2026-84224
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
4.1
Medium
CVE-2026-84223
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
6.8
Medium
CVE-2026-84222
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
5.3
Medium