Unknown Kirki vulnerabilities

• themeum kirki Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL CVE-2026-84224 4.1 MediumOctober 9, 2026
• themeum kirki Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection CVE-2026-84220 4.8 MediumOctober 9, 2026
• themeum kirki Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload CVE-2026-84223 6.8 MediumSeptember 20, 2026
• themeum kirki Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter CVE-2026-84222 5.3 MediumSeptember 9, 2026
• themeum kirki Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding CVE-2026-84219 7.5 HighSeptember 6, 2026
• themeum kirki Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR CVE-2026-84225 2.2 LowSeptember 5, 2026
• themeum kirki Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID CVE-2026-84221 6.8 MediumSeptember 5, 2026
• themeum kirki Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis CVE-2026-77754 5.3 MediumAugust 26, 2026
• themeum kirki Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload CVE-2026-74992 6.8 MediumAugust 20, 2026
• themeum kirki Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions CVE-2026-16747 6.5 MediumAugust 12, 2026
• themeum kirki Kirki < 6.0.13 - Unauthenticated SQL Injection CVE-2026-12721 8.6 HighJuly 31, 2026
• themeum kirki Kirki < 6.0.13 - Unauthenticated PHP Object Injection CVE-2026-12720 7.5 HighJuly 31, 2026
• themeum kirki Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis CVE-2026-13147 9.1 CriticalJuly 20, 2026
• themeum kirki Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password CVE-2026-12724 4.3 MediumJuly 20, 2026
• themeum kirki Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library CVE-2026-12723 5.3 MediumJuly 20, 2026