What’s Vulnerable › Products

Kirki vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your Kirki version is affected

Latest Kirki vulnerabilities

• CVE-2026-84224 — Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL (CVSS 4.1)
• CVE-2026-84220 — Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection (CVSS 4.8)
• CVE-2026-84223 — Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload (CVSS 6.8)
• CVE-2026-84222 — Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter (CVSS 5.3)
• CVE-2026-84219 — Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding (CVSS 7.5)
• CVE-2026-84225 — Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR (CVSS 2.2)
• CVE-2026-84221 — Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID (CVSS 6.8)
• CVE-2026-77754 — Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis (CVSS 5.3)
• CVE-2026-74992 — Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload (CVSS 6.8)
• CVE-2026-16747 — Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions (CVSS 6.5)
• CVE-2026-12721 — Kirki < 6.0.13 - Unauthenticated SQL Injection (CVSS 8.6)
• CVE-2026-12720 — Kirki < 6.0.13 - Unauthenticated PHP Object Injection (CVSS 7.5)
• CVE-2026-13147 — Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis (CVSS 9.1)
• CVE-2026-12724 — Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password (CVSS 4.3)
• CVE-2026-12723 — Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library (CVSS 5.3)