Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Kirki (e45a867f-1a48-5f55-8a55-f59d4131fd0a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-84223 |
vulnerable | 2026-10-13 12:28:55.732322 |
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Published: 2026-09-20T06:00:16.686Z
Updated: 2026-09-20T13:49:20.467Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84222 |
vulnerable | 2026-09-16 04:33:10.573416 |
Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
Published: 2026-09-09T06:00:08.247Z
Updated: 2026-09-09T15:29:32.155Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84219 |
vulnerable | 2026-09-16 04:33:10.343030 |
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.
Published: 2026-09-06T06:00:04.619Z
Updated: 2026-09-06T10:44:25.273Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84225 |
vulnerable | 2026-09-16 04:33:10.303020 |
Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
Published: 2026-09-05T06:00:08.348Z
Updated: 2026-09-06T10:37:38.481Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84221 |
vulnerable | 2026-09-16 04:33:10.246712 |
Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
Published: 2026-09-05T06:00:08.170Z
Updated: 2026-09-06T10:37:53.220Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16747 |
vulnerable | 2026-09-16 04:32:56.883557 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12720 |
vulnerable | 2026-09-16 04:32:51.537862 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12721 |
vulnerable | 2026-09-16 04:32:51.445217 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13147 |
vulnerable | 2026-07-29 00:23:32.851622 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12724 |
vulnerable | 2026-07-29 00:23:32.531580 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12723 |
vulnerable | 2026-07-29 00:23:32.531363 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.