Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Kirki 6.0.13 Clear all filters
TI-2026-10873 CVE-2026-12721 · GHSA-8m37-w7r8-hcp2

Kirki < 6.0.13 - Unauthenticated SQL Injection

Priority MEDIUM 44

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00445 Published 2026-07-31 Fixed in 6.0.13 CWE-89
TI-2026-10872 CVE-2026-12720 · GHSA-rpvq-6gf9-58vg

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

Priority LOW 35

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an admin…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00525 Published 2026-07-31 Fixed in 6.0.13 CWE-502