CVE-2026-74992— Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-74992
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
Source: CVE Program / CVE List V5
Vulnerability Description
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74992
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74992
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74992 (1)
- 🔗 Kirki < 6.2.3 – Editor+ Stored XSS via Font Zip Upload | CVE 2026-74992 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-20 · 7 CVEs total
| CVE-2026-75860 | JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update | |
| CVE-2026-19699 | GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure | |
| CVE-2026-19615 | Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC | |
| CVE-2026-19697 | GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-15049 | Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import | |
| CVE-2026-13405 | Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder |
IV. Related Vulnerabilities
Same product: Kirki
- CVE-2026-66629
WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) - CVE-2026-16747
Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Executio - CVE-2026-12721
Kirki < 6.0.13 - Unauthenticated SQL Injection - CVE-2026-12720
Kirki < 6.0.13 - Unauthenticated PHP Object Injection - CVE-2026-65436
WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion v
Same vendor: Unknown
- CVE-2026-75796
AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administr - CVE-2026-16577
Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulat - CVE-2026-16959
Media Library Assistant < 3.40 - Author+ SQL Injection via m - CVE-2026-18781
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3. - CVE-2026-19435
Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post C
V. Comments for CVE-2026-74992
No comments yet