Kirki vulnerabilities
We track 3 vulnerabilities in Kirki products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 6, 2026.
Latest Kirki vulnerabilities
- 7.5 High severity
Kirki: Improper Neutralization of Input During Web Page Generation
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it,
- 8.6 High severity
Kirki: Improper Neutralization of Special Elements used in an SQL Command
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- 7.5 High severity
Kirki: Deserialization of Untrusted Data
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data.