Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Kirki (e45a867f-1a48-5f55-8a55-f59d4131fd0a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-13147 |
vulnerable | 2026-07-29 00:23:32.851622 |
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Published: 2026-07-20T06:00:04.766Z
Updated: 2026-07-20T13:13:37.074Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12724 |
vulnerable | 2026-07-29 00:23:32.531580 |
Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
Published: 2026-07-20T06:00:03.572Z
Updated: 2026-07-20T15:05:55.528Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12723 |
vulnerable | 2026-07-29 00:23:32.531363 |
Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
Published: 2026-07-20T06:00:03.332Z
Updated: 2026-07-20T15:05:08.888Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.