Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Kirki — Vulnerabilities & Security Advisories 24

All 24 CVE vulnerabilities found in Kirki, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities associated with the Kirki WordPress framework, specifically focusing on code injection flaws and improper input validation issues. The collection encompasses a comprehensive history of reported weaknesses discovered and disclosed between 2016 and the present, drawing data from official vendor advisories, independent researcher reports, and public security databases. Visitors can utilize this resource to track the release history of security patches for the Kirki project, analyze the prevalence of specific weakness classes within the plugin ecosystem, or review the complete vulnerability timeline for this particular product to assess its current security posture. The data presented here serves as a neutral reference for security professionals, developers, and system administrators who require accurate historical context regarding the software's evolution and risk profile. By consolidating these findings into a single view, the page eliminates the need to cross-reference multiple disparate sources when investigating potential threats related to this theme customizer. Users seeking to understand the long-term security maintenance of Kirki will find detailed summaries of each incident, including affected versions and the nature of the underlying defects, facilitating informed decisions about software usage and upgrade strategies without relying on fragmented information scattered across the internet.

Vendor: Themeum

CVE ID Title CVSS Severity Published
CVE-2026-84224 Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL 4.1 Medium 2026-10-09
CVE-2026-84220 Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection 4.8 Medium 2026-10-09
CVE-2026-103065 WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability CWE-1284 8.2 High 2026-10-03
CVE-2026-84223 Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload - - 2026-09-20
CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter - - 2026-09-09
CVE-2026-84219 Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding - - 2026-09-06
CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID - - 2026-09-05
CVE-2026-84225 Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR - - 2026-09-05
CVE-2026-77754 Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis - - 2026-08-26
CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload - - 2026-08-20
CVE-2026-66629 WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-08-18
CVE-2026-16747 Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions 6.5 Medium 2026-08-12
CVE-2026-12721 Kirki < 6.0.13 - Unauthenticated SQL Injection - - 2026-07-31
CVE-2026-12720 Kirki < 6.0.13 - Unauthenticated PHP Object Injection - - 2026-07-31
CVE-2026-65436 WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability CWE-22 6.8 Medium 2026-07-27
CVE-2026-13147 Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis - - 2026-07-20
CVE-2026-12724 Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password - - 2026-07-20
CVE-2026-12723 Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library - - 2026-07-20
CVE-2026-57727 WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability CWE-862 7.5 High 2026-07-13
CVE-2026-57724 WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability CWE-502 9.8 Critical 2026-07-13
CVE-2026-57726 WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-07-13
CVE-2026-57725 WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-07-13
CVE-2026-57680 WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability CWE-639 6.5 Medium 2026-07-02
CVE-2026-57627 WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability CWE-918 4.9 Medium 2026-06-26

All 24 known CVE vulnerabilities affecting Kirki with full Chinese analysis, references, and POCs where available.