6.8
Moyenne
CVE-2026-84223 The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
Description
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kirki 6.0 | 6.0.0 → < 6.3.1 | 6.3.1 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Kirki
Les 15 CVE de Kirki →
CVE-2026-84220
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
4.8
Moyenne
CVE-2026-84224
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
4.1
Moyenne
CVE-2026-84222
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
5.3
Moyenne
CVE-2026-84219
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when…
7.5
Élevée