Kirki vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

KI

Product

Kirki

by · last CVE Oct 9, 2026

15

CVEs

0

On KEV

9.1

Max CVSS

2

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 1High 3Medium 10Low 1

Severity

All severities15 Critical1 High3 Medium10 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Kirki to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-13147	9.1	1%	Jul 20	Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis Affected: before 6.0.12
CVE-2026-12721	8.6	0%	Jul 31	Kirki < 6.0.13 - Unauthenticated SQL Injection Affected: before 6.0.13
CVE-2026-84219	7.5	0%	Sep 6	Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding Affected: 6.2.1 before 6.3.0
CVE-2026-12720	7.5	1%	Jul 31	Kirki < 6.0.13 - Unauthenticated PHP Object Injection Affected: before 6.0.13
CVE-2026-84223	6.8	0%	Sep 20	Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload Affected: 6.0.0 before 6.3.1
CVE-2026-84221	6.8	0%	Sep 5	Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID Affected: 6.0.0 before 6.3.0
CVE-2026-74992	6.8	0%	Aug 20	Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload Affected: before 6.2.3
CVE-2026-16747	6.5	0%	Aug 12	Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions Affected: before 6.2.1
CVE-2026-84222	5.3	0%	Sep 9	Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter Affected: 6.2.1 before 6.3.0
CVE-2026-77754	5.3	0%	Aug 26	Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis Affected: before 6.0.14
CVE-2026-12723	5.3	0%	Jul 20	Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library Affected: before 6.0.12
CVE-2026-84220	4.8	0%	Oct 9	Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection Affected: before 6.3.2
CVE-2026-12724	4.3	0%	Jul 20	Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password Affected: before 6.0.12
CVE-2026-84224	4.1	0%	Oct 9	Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL Affected: before 6.3.2
CVE-2026-84225	2.2	0%	Sep 5	Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR Affected: 6.0.0 before 6.3.0