Kirki – Freeform Page Builder, Website Builder & Customizer

Уязвимости

• CVE-2026-57724без авторизации≤ 6.0.12

  WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

  Критич. 9.8

• CVE-2026-8206без авторизации≤ 6.0.6

  Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

  Критич. 9.8

• CVE-2026-57726без авторизации≤ 6.0.12

  WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-103065без авторизации≤ 6.3.1

  WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

  Высокий 8.2

• CVE-2026-57727без авторизации≤ 6.0.13

  WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerability

  Высокий 7.5

• CVE-2026-8073без авторизации≤ 6.0.6

  Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP

  Высокий 7.5

• CVE-2026-66629без авторизации · нужен клик≤ 6.2.3

  WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-57725без авторизации · нужен клик≤ 6.0.11

  WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-65436редактор+≤ 6.0.13

  WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

  Средний 6.8

• CVE-2026-57680без авторизации≤ 6.0.11

  WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability

  Средний 6.5

• CVE-2026-8096подписчик+≤ 6.0.6

  Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action

  Средний 6.5

• CVE-2026-13464без авторизации≤ 6.0.14

  Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

  Средний 5.3

• CVE-2026-12472без авторизации≤ 6.0.11

  Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Paramete

  Средний 5.3

• CVE-2026-12122без авторизации≤ 6.0.11

  Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action

  Средний 5.3

• CVE-2026-57627подписчик+≤ 6.0.11

  WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability

  Средний 4.9

• CVE-2026-17604редактор+≤ 6.1.1

  Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

  Средний 4.9

• CVE-2026-15601редактор+≤ 6.0.13

  Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

  Средний 4.9

• CVE-2026-15457редактор+≤ 6.0.13

  Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter

  Средний 4.9

• CVE-2026-18347подписчик+≤ 6.1.1

  Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter

  Средний 4.3