sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total43
Critical4
High12
Medium26
Reset
Showing 21-40 of 43 records
Threat Entry Updated 2026-08-20

Kirki - Broken Access Control (CVE-2026-18347)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target…

PLUGIN Kirki

CVE-2026-18347

MEDIUM CVSS 4.3 2026-08-16
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Kirki - Security Vulnerability (CVE-2026-16747)

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

PLUGIN Kirki

CVE-2026-16747

MEDIUM CVSS 6.5 2026-08-12
Open Full Technical Breakdown
Threat Entry Updated 2026-08-12

Kirki - Cross-Site Scripting (XSS) (CVE-2026-16974)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

THEME Kirki

CVE-2026-16974

MEDIUM CVSS 6.4 2026-08-11
Open Full Technical Breakdown
Threat Entry Updated 2026-08-12

Kirki - Remote Code Execution (CVE-2026-15601)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and…

PLUGIN Kirki

CVE-2026-15601

MEDIUM CVSS 4.9 2026-08-01
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Kirki - SQL Injection (CVE-2026-12721)

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

PLUGIN Kirki

CVE-2026-12721

HIGH CVSS 8.6 2026-07-31
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Kirki - Remote Code Execution (CVE-2026-12720)

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.

PLUGIN Kirki

CVE-2026-12720

HIGH CVSS 7.5 2026-07-31
Open Full Technical Breakdown
Threat Entry Updated 2026-07-24

Kirki - Security Vulnerability (CVE-2026-13464)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.

PLUGIN Kirki

CVE-2026-13464

MEDIUM CVSS 5.3 2026-07-24
Open Full Technical Breakdown
Threat Entry Updated 2026-07-20

Kirki - Security Vulnerability (CVE-2026-12723)

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.

PLUGIN Kirki

CVE-2026-12723

MEDIUM CVSS 5.3 2026-07-20
Open Full Technical Breakdown
Threat Entry Updated 2026-07-20

Kirki - Cross-Site Scripting (XSS) (CVE-2026-12724)

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.

PLUGIN Kirki

CVE-2026-12724

MEDIUM CVSS 4.3 2026-07-20
Open Full Technical Breakdown
Threat Entry Updated 2026-07-21

Kirki - Path Traversal (CVE-2026-15457)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.

PLUGIN Kirki

CVE-2026-15457

MEDIUM CVSS 4.9 2026-07-17
Open Full Technical Breakdown
Threat Entry Updated 2026-07-13

Kirki - SQL Injection (CVE-2026-57726)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through

PLUGIN Kirki

CVE-2026-57726

CRITICAL CVSS 9.3 2026-07-13
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

Kirki - Broken Access Control (CVE-2026-12472)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter…

THEME Kirki

CVE-2026-12472

MEDIUM CVSS 5.3 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

Kirki - Information Disclosure (CVE-2026-12122)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.

THEME Kirki

CVE-2026-12122

MEDIUM CVSS 5.3 2026-07-02
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.