Skip to content
Threat Feed
Subscribe

Vendor

Kirki

3 briefs RSS
high advisory

PHP Object Injection in Kirki WordPress Plugin

The Kirki WordPress plugin is vulnerable to PHP Object Injection in versions 6.3.2 and earlier, allowing authenticated users with Editor or Administrator access to trigger deserialization of untrusted input.

Kirki – Freeform Page Builder, Website Builder & Customizer wordpress vulnerability php-injection web-application
1t 1c
high advisory

Stored XSS in Kirki WordPress Plugin via Registration Metadata

The Kirki plugin for WordPress is vulnerable to Stored XSS due to insufficient input validation in registration metadata, allowing unauthenticated attackers to inject malicious scripts.

Kirki – Freeform Page Builder, Website Builder & Customizer
2t 1c
high advisory

Stored Cross-Site Scripting in Kirki WordPress Plugin

The Kirki plugin for WordPress version 6.2.0 and below is susceptible to unauthenticated Stored Cross-Site Scripting (XSS) via the 'comment' parameter, potentially leading to unauthorized script execution in administrative or user sessions.

Kirki – Freeform Page Builder, Website Builder & Customizer wordpress xss vulnerability
2t 1c