Kirki vulnerabilities | LiveThreat CVE Feed

Product

Kirki

by Themeum · last CVE Oct 3, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 2High 4Medium 3Low 0

Severity

Exploitation

Watch

Add Kirki to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-103065	8.2	0%	Oct 3	WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability Affected: through 6.3.1
CVE-2026-57727	7.5	0%	Jul 13	WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability Affected: through 6.2.0
CVE-2026-66629	7.1	0%	Aug 18	WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability Affected: through 6.2.3
CVE-2026-57725	7.1	0%	Jul 13	WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability Affected: through 6.0.11