Unknown Kirki

5 known vulnerabilities in Unknown Kirki, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-84223 CVSS 6.8 medium The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with…
  • CVE-2026-84222 CVSS 5.3 medium The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its…
  • CVE-2026-84219 CVSS 7.5 high The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing…
  • CVE-2026-84225 CVSS 2.2 low The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state…
  • CVE-2026-84221 CVSS 6.8 medium The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with…