9.1
Critical
CVE-2026-13147 The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side,…
Description
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kirki 6.0 | earliest → < 6.0.12 | 6.0.12 |
Other CVEs of Kirki
The 15 CVEs of Kirki →
CVE-2026-84220
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
4.8
Medium
CVE-2026-84224
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
4.1
Medium
CVE-2026-84223
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
6.8
Medium
CVE-2026-84222
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
5.3
Medium