Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 36

Reset filters

Medium 09.10.2026

CVE-2026-102291

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'

The Kirki plugin for WordPress allows authenticated attackers with Subscriber access or higher to execute arbitrary shortcodes via the display_name field when dynamic user content is displayed on published pages.

High 06.10.2026

CVE-2026-102173

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

Critical 01.10.2026

CVE-2026-103065

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution

Medium 23.09.2026

CVE-2026-18335

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter

Medium 18.09.2026

CVE-2026-84223

Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting

High 10.09.2026

CVE-2026-17037

Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter

Medium 09.09.2026

CVE-2026-84222

Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Information Exposure

High 08.09.2026

CVE-2026-84219

Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Stored Cross-Site Scripting

Medium 05.09.2026

CVE-2026-84225

Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference

Medium 05.09.2026

CVE-2026-84221

Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Editor+) SQL Injection

Medium 26.08.2026

CVE-2026-77754

Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.14 - Missing Authorization

Critical 24.08.2026

CVE-2026-16747

Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.1 - Unauthenticated Remote Code Execution

Medium 21.08.2026

CVE-2026-74992

Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting

High 18.08.2026

CVE-2026-66629

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting

Medium 15.08.2026

CVE-2026-18347

Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter

Medium 15.08.2026

CVE-2026-17604

Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

Medium 10.08.2026

CVE-2026-16974

Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode

High 04.08.2026

CVE-2026-12720

Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection

Medium 31.07.2026

CVE-2026-15601

Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

Medium 23.07.2026

CVE-2026-13464

Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

Medium 16.07.2026

CVE-2026-15457

Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter

High 14.07.2026

CVE-2026-12721

Kirki <= 6.0.12 - Unauthenticated SQL Injection

Medium 06.07.2026

CVE-2026-57727

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Missing Authorization

High 06.07.2026

CVE-2026-57725

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting

Showing 1 to 24 of 36 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 36

Know which vulnerabilities affect your application

Application security in your inbox