Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Kirki 6.0.12 Clear all filters
TI-2026-11164 CVE-2026-13147 · GHSA-74x7-v2vc-6vgc

Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

Priority HIGH 80

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Req…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01466 Published 2026-07-20 Fixed in 6.0.12
TI-2026-10876 CVE-2026-12724 · GHSA-xg2c-9mhj-9pvj

Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password

Priority MEDIUM 53

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated us…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00146 Published 2026-07-20 Fixed in 6.0.12 CWE-345
TI-2026-10875 CVE-2026-12723 · GHSA-f5q9-9w7q-q2jv

Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library

Priority MEDIUM 63

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approv…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00339 Published 2026-07-20 Fixed in 6.0.12 CWE-862