Skip to content
OpenAdvisories

Product · Themeum

Kirki

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.6
    CVE-2026-112347

    Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

    Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely o…

    Themeum Kirki Web / CMS
  • High 8.2
    CVE-2026-103065

    WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

    Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

    Themeum Kirki
  • High 7.1
    CVE-2026-66629

    WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

    Themeum Kirki
  • High 7.1
    CVE-2026-57725

    WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.

    Themeum Kirki
  • High 7.5
    CVE-2026-57727

    WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0.

    Themeum Kirki