Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Kirki - Security Vulnerability (CVE-2026-112348)
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.
PLUGIN
Kirki
CVE-2026-112348
Risk Score
Threat Entry
Updated 2026-10-30
Kirki - Security Vulnerability (CVE-2026-112347)
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not…
PLUGIN
Kirki
CVE-2026-112347
Risk Score
Threat Entry
Updated 2026-10-30
Kirki - Security Vulnerability (CVE-2026-42694)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.
PLUGIN
Kirki
CVE-2026-42694
Risk Score
Threat Entry
Updated 2026-10-29
Kirki - Security Vulnerability (CVE-2026-75891)
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
PLUGIN
Kirki
CVE-2026-75891
Risk Score
Threat Entry
Updated 2026-10-10
Kirki - Security Vulnerability (CVE-2026-102291)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a…
PLUGIN
Kirki
CVE-2026-102291
Risk Score
Threat Entry
Updated 2026-10-09
Kirki - Security Vulnerability (CVE-2026-84224)
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
PLUGIN
Kirki
CVE-2026-84224
Risk Score
Threat Entry
Updated 2026-10-09
Kirki - Security Vulnerability (CVE-2026-84220)
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
PLUGIN
Kirki
CVE-2026-84220
Risk Score
Threat Entry
Updated 2026-10-07
Kirki - Security Vulnerability (CVE-2026-102173)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration…
PLUGIN
Kirki
CVE-2026-102173
Risk Score
Threat Entry
Updated 2026-10-06
Kirki - Security Vulnerability (CVE-2026-103065)
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
THEME
Kirki
CVE-2026-103065
Risk Score
Threat Entry
Updated 2026-09-24
Kirki - Security Vulnerability (CVE-2026-18335)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Kirki
CVE-2026-18335
Risk Score
Threat Entry
Updated 2026-09-21
Kirki - Security Vulnerability (CVE-2026-84223)
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
PLUGIN
Kirki
CVE-2026-84223
Risk Score
Threat Entry
Updated 2026-09-11
Kirki - Cross-Site Scripting (XSS) (CVE-2026-17037)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Kirki
CVE-2026-17037
Risk Score
Threat Entry
Updated 2026-09-09
Kirki - Security Vulnerability (CVE-2026-84222)
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
PLUGIN
Kirki
CVE-2026-84222
Risk Score
Threat Entry
Updated 2026-09-08
Kirki - Security Vulnerability (CVE-2026-84219)
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.
PLUGIN
Kirki
CVE-2026-84219
Risk Score
Threat Entry
Updated 2026-09-08
Kirki - Cross-Site Scripting (XSS) (CVE-2026-84221)
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
PLUGIN
Kirki
CVE-2026-84221
Risk Score
Threat Entry
Updated 2026-09-08
Kirki - Security Vulnerability (CVE-2026-84225)
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
PLUGIN
Kirki
CVE-2026-84225
Risk Score
Threat Entry
Updated 2026-08-26
Kirki - Broken Access Control (CVE-2026-77754)
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
PLUGIN
Kirki
CVE-2026-77754
Risk Score
Threat Entry
Updated 2026-08-26
Kirki - Remote Code Execution (CVE-2026-74992)
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
PLUGIN
Kirki
CVE-2026-74992
Risk Score
Threat Entry
Updated 2026-10-22
Kirki - Cross-Site Scripting (XSS) (CVE-2026-66629)
Unauthenticated Cross Site Scripting (XSS) in Kirki
PLUGIN
Kirki
CVE-2026-66629
Risk Score
Threat Entry
Updated 2026-08-20
Kirki - Path Traversal (CVE-2026-17604)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
PLUGIN
Kirki
CVE-2026-17604
Risk Score