| CVE-2026-84220 |
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders…
|
4.8
Moyenne
|
9 oct. 2026 |
| CVE-2026-84224 |
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing…
|
4.1
Moyenne
|
9 oct. 2026 |
| CVE-2026-84223 |
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide,…
|
6.8
Moyenne
|
20 sept. 2026 |
| CVE-2026-84222 |
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering…
|
5.3
Moyenne
|
9 sept. 2026 |
| CVE-2026-84219 |
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when…
|
7.5
Élevée
|
6 sept. 2026 |
| CVE-2026-84221 |
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query,…
|
6.8
Moyenne
|
5 sept. 2026 |
| CVE-2026-84225 |
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment…
|
2.2
Faible
|
5 sept. 2026 |
| CVE-2026-77754 |
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public…
|
5.3
Moyenne
|
26 août 2026 |
| CVE-2026-74992 |
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users…
|
6.8
Moyenne
|
20 août 2026 |
| CVE-2026-16747 |
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes…
|
6.5
Moyenne
|
12 août 2026 |
| CVE-2026-12720 |
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises…
|
7.5
Élevée
|
31 juil. 2026 |
| CVE-2026-12721 |
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before…
|
8.6
Élevée
|
31 juil. 2026 |
| CVE-2026-13147 |
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side,…
|
9.1
Critique
|
20 juil. 2026 |
| CVE-2026-12724 |
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a…
|
4.3
Moyenne
|
20 juil. 2026 |
| CVE-2026-12723 |
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing…
|
5.3
Moyenne
|
20 juil. 2026 |