Wpkube Kiwi vulnerabilities

• kiwitcms kiwi Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase) CVE-2026-55630 0.0 NoneJuly 6, 2026
• kiwitcms kiwi Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint CVE-2026-54724 6.1 MediumJuly 6, 2026
• kiwitcms kiwi Kiwi TCMS: The /init-db/ page renders and responds to requests after first use CVE-2026-49292 0.0 NoneJuly 2, 2026
• wpkube kiwi WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability CVE-2025-58790 6.5 MediumSeptember 5, 2025
• wpkube social sharing plugin – kiwi, kiwi social share +1 more Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure CVE-2024-3228 5.3 MediumJuly 9, 2024
• kiwitcms kiwi, kiwi tcms +1 more Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVE-2023-36809 Fix available 8.1 HighJuly 5, 2023
• wpkube kiwi social share, social sharing plugin – kiwi +1 more The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing... CVE-2021-4362 9.8 CriticalJune 7, 2023
• kiwitcms kiwi, kiwi tcms +1 more Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVE-2023-33977 Public exploitFix available 8.1 HighJune 6, 2023
• kiwitcms kiwi, kiwi tcms +1 more kiwitcms vulnerable to stored XSS via unrestricted files upload CVE-2023-32686 Fix available 8.1 HighMay 22, 2023
• kiwitcms kiwi, kiwi tcms +1 more Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVE-2023-30628 Fix available 8.8 HighApril 24, 2023
• kiwitcms kiwi, kiwi tcms +1 more Kiwi TCMS unrestricted file upload vulnerability CVE-2023-30613 Fix available 8.1 HighApril 24, 2023
• kiwitcms kiwi, kiwi tcms +1 more Kiwi TCMS may allow user to update email address to unverified one CVE-2023-30544 Fix available 3.9 LowApril 24, 2023
• kiwitcms kiwi, kiwi tcms +1 more Stored cross site scripting via SVG file upload in Kiwi TCMS CVE-2023-27489 Fix available 7.6 HighMarch 29, 2023
• kiwitcms kiwi, kiwi tcms +1 more Kiwi TCMS has denial of service vulnerability on Password reset page CVE-2023-25171 Fix available 7.5 HighFebruary 15, 2023
• kiwitcms kiwi, kiwi tcms +1 more Kiwi TCMS has no protection against brute-force attacks on login page CVE-2023-25156 Fix available 7.5 HighFebruary 15, 2023
• kiwitcms kiwi, kiwi tcms +1 more Weak password requirements in Kiwi TCMS CVE-2023-22451 6.5 MediumJanuary 2, 2023