Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:kirki:kirki:*:*:*:*:*:wordpress:*:*

3 briefs RSS
high advisory

CVE-2026-107762: IDOR Vulnerability in Kirki WordPress Plugin

The Kirki plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw via the 'context' parameter, allowing unauthenticated attackers to exfiltrate sensitive user profile data.

Kirki
2t 1c
high advisory

PHP Object Injection in Kirki WordPress Plugin

The Kirki WordPress plugin is vulnerable to PHP Object Injection in versions 6.3.2 and earlier, allowing authenticated users with Editor or Administrator access to trigger deserialization of untrusted input.

Kirki – Freeform Page Builder, Website Builder & Customizer wordpress vulnerability php-injection web-application
1t 1c
high advisory

Stored Cross-Site Scripting in Kirki WordPress Plugin

The Kirki plugin for WordPress version 6.2.0 and below is susceptible to unauthenticated Stored Cross-Site Scripting (XSS) via the 'comment' parameter, potentially leading to unauthorized script execution in administrative or user sessions.

Kirki – Freeform Page Builder, Website Builder & Customizer wordpress xss vulnerability
2t 1c