Kirki vulnerabilities | LiveThreat CVE Feed

Product

Kirki

by Themeum · last CVE Oct 3, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 2High 4Medium 3Low 0

Severity

Exploitation

Watch

Add Kirki to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-65436	6.8	1%	Jul 27	WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability Affected: through 6.0.13
CVE-2026-57680	6.5	0%	Jul 2	WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability Affected: through 6.0.11
CVE-2026-57627	4.9	0%	Jun 26	WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability Affected: through 6.0.11