Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Kirki 6.3.0 Clear all filters
TI-2026-57911 CVE-2026-84225 · GHSA-gf6x-qf8h-8g89

Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR

Priority LOW 11

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page…

CVSS 3.1LOW 2.2 Network High privileges No interaction EPSS 0.00232 Published 2026-09-05 Fixed in 6.3.0 CWE-639
TI-2026-57908 CVE-2026-84221 · GHSA-78r9-6m52-hhpv

Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

Priority LOW 30

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the da…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00398 Published 2026-09-05 Fixed in 6.3.0 CWE-89