Themeum Kirki vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Themeum Kirki: 8 record(s), with affected versions and fixes.

CVE-2026-103065 High · 8.2 CWE-1284 Oct 3, 2026

WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

CVE-2026-65436 Medium · 6.8 CWE-22 Jul 27, 2026

WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

CVE-2026-57727 High · 7.5 CWE-862 Jul 13, 2026

WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through <= 6.0.13.

CVE-2026-57726 Critical · 9.3 CWE-89 Jul 13, 2026

WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.

CVE-2026-57725 High · 7.1 CWE-79 Jul 13, 2026

WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.

CVE-2026-57724 Critical · 9.8 CWE-502 Jul 13, 2026

WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.

CVE-2026-57680 Medium · 6.5 CWE-639 Jul 2, 2026

WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

CVE-2026-57627 Medium · 4.9 CWE-918 Jun 26, 2026

WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.