Filtered by vendor Themeum Subscriptions
Filtered by product Kirki Subscriptions
Total 12 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-14572 2 Themeum, Wordpress-extensions 2 Kirki, Kirki 2026-10-23 6.4 Medium
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-107762 2 Themeum, Wordpress-extensions 2 Kirki, Kirki 2026-10-23 7.5 High
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.
CVE-2026-57727 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-10-19 7.5 High
Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0.
CVE-2026-104734 2 Themeum, Wordpress-extensions 2 Kirki, Kirki 2026-10-18 7.2 High
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.
CVE-2026-103065 2 Themeum, Wordpress-extensions 2 Kirki, Kirki 2026-10-04 8.2 High
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
CVE-2026-66629 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.
CVE-2026-65436 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-07-28 6.8 Medium
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.
CVE-2026-57725 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-07-13 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.
CVE-2026-57726 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-07-13 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.
CVE-2026-57724 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-07-13 9.8 Critical
Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
CVE-2026-57680 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-07-02 6.5 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.
CVE-2026-57627 2 Themeum, Wordpress 2 Kirki, Wordpress 2026-06-29 4.9 Medium
Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.