9.1
Critique
CVE-2026-13147 The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side,…
Description
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kirki 6.0 | premières → < 6.0.12 | 6.0.12 |
Autres CVE de Kirki
Les 15 CVE de Kirki →
CVE-2026-84220
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
4.8
Moyenne
CVE-2026-84224
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
4.1
Moyenne
CVE-2026-84223
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
6.8
Moyenne
CVE-2026-84222
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
5.3
Moyenne