Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Kirki 6.3.2 Clear all filters
TI-2026-69902 CVE-2026-84224 · GHSA-w2rx-5q64-f3mg

Blind SSRF in Kirki WordPress plugin via remote template URL

Priority LOW 18

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are…

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00179 Published 2026-10-09 Fixed in 6.3.2 CWE-918
TI-2026-69901 CVE-2026-84220 · GHSA-wv2j-h628-x2ww

Shortcode execution in Kirki WordPress plugin via comments

Priority LOW 21

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitor…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00141 Published 2026-10-09 Fixed in 6.3.2 CWE-74