Themeum Kirki vulnerabilities

• themeum kirki Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token CVE-2026-112348 6.9 MediumOctober 30, 2026
• themeum kirki Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API CVE-2026-112347 7.2 HighOctober 30, 2026
• themeum kirki WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability CVE-2026-42694 4.3 MediumOctober 29, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint CVE-2026-75891 8.8 HighOctober 27, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter CVE-2026-107762 7.5 HighOctober 17, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import CVE-2026-104734 7.2 HighOctober 17, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content CVE-2026-14572 6.4 MediumOctober 15, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' CVE-2026-102291 5.4 MediumOctober 10, 2026
• themeum kirki Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL CVE-2026-84224 4.1 MediumOctober 9, 2026
• themeum kirki Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection CVE-2026-84220 4.8 MediumOctober 9, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata CVE-2026-102173 7.2 HighOctober 7, 2026
• themeum kirki WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability CVE-2026-103065 8.2 HighOctober 3, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter CVE-2026-18335 5.4 MediumSeptember 24, 2026
• themeum kirki Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload CVE-2026-84223 6.8 MediumSeptember 20, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter CVE-2026-17037 7.2 HighSeptember 11, 2026
• themeum kirki Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter CVE-2026-84222 5.3 MediumSeptember 9, 2026
• themeum kirki Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding CVE-2026-84219 7.5 HighSeptember 6, 2026
• themeum kirki Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR CVE-2026-84225 2.2 LowSeptember 5, 2026
• themeum kirki Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID CVE-2026-84221 6.8 MediumSeptember 5, 2026
• themeum kirki Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis CVE-2026-77754 5.3 MediumAugust 26, 2026
• themeum kirki Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload CVE-2026-74992 6.8 MediumAugust 20, 2026
• themeum kirki WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-66629 7.1 HighAugust 18, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter CVE-2026-18347 4.3 MediumAugust 16, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter CVE-2026-17604 4.9 MediumAugust 16, 2026
• themeum kirki Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions CVE-2026-16747 6.5 MediumAugust 12, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode CVE-2026-16974 6.4 MediumAugust 11, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) CVE-2026-15601 4.9 MediumAugust 1, 2026
• themeum kirki Kirki < 6.0.13 - Unauthenticated SQL Injection CVE-2026-12721 8.6 HighJuly 31, 2026
• themeum kirki Kirki < 6.0.13 - Unauthenticated PHP Object Injection CVE-2026-12720 7.5 HighJuly 31, 2026
• themeum kirki WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability CVE-2026-65436 6.8 MediumJuly 27, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CVE-2026-13464 5.3 MediumJuly 24, 2026
• themeum kirki Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis CVE-2026-13147 9.1 CriticalJuly 20, 2026
• themeum kirki Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password CVE-2026-12724 4.3 MediumJuly 20, 2026
• themeum kirki Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library CVE-2026-12723 5.3 MediumJuly 20, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter CVE-2026-15457 4.9 MediumJuly 17, 2026
• themeum kirki WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability CVE-2026-57727 7.5 HighJuly 13, 2026
• themeum kirki WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability CVE-2026-57726 9.3 CriticalJuly 13, 2026
• themeum kirki WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability CVE-2026-57725 7.1 HighJuly 13, 2026
• themeum kirki WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability CVE-2026-57724 9.8 CriticalJuly 13, 2026
• themeum kirki WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-57680 6.5 MediumJuly 2, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters CVE-2026-12472 5.3 MediumJuly 2, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action CVE-2026-12122 5.3 MediumJuly 2, 2026
• themeum kirki WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-57627 4.9 MediumJune 26, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' CVE-2026-8206 Public exploit 9.8 CriticalJune 2, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP CVE-2026-8073 7.5 HighMay 19, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action CVE-2026-8096 6.5 MediumMay 19, 2026