| CVE-2026-84220 |
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
|
4.8
Medium
|
Oct 9, 2026 |
| CVE-2026-84224 |
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
|
4.1
Medium
|
Oct 9, 2026 |
| CVE-2026-84223 |
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
|
6.8
Medium
|
Sep 20, 2026 |
| CVE-2026-84222 |
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
|
5.3
Medium
|
Sep 9, 2026 |
| CVE-2026-84219 |
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when…
|
7.5
High
|
Sep 6, 2026 |
| CVE-2026-84221 |
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query,…
|
6.8
Medium
|
Sep 5, 2026 |
| CVE-2026-84225 |
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment…
|
2.2
Low
|
Sep 5, 2026 |
| CVE-2026-77754 |
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public…
|
5.3
Medium
|
Aug 26, 2026 |
| CVE-2026-74992 |
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users…
|
6.8
Medium
|
Aug 20, 2026 |
| CVE-2026-16747 |
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes…
|
6.5
Medium
|
Aug 12, 2026 |
| CVE-2026-12720 |
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises…
|
7.5
High
|
Jul 31, 2026 |
| CVE-2026-12721 |
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before…
|
8.6
High
|
Jul 31, 2026 |
| CVE-2026-13147 |
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side,…
|
9.1
Critical
|
Jul 20, 2026 |
| CVE-2026-12724 |
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a…
|
4.3
Medium
|
Jul 20, 2026 |
| CVE-2026-12723 |
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing…
|
5.3
Medium
|
Jul 20, 2026 |