WordPress Kirki < 6.0.12 - Server-Side Request Forgery

Kirki WordPress plugin 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication. id: CVE-2026-13147 info: name: WordPress Kirki 6.0.12 - Server-Side...

CVE-2026-PoCs

CVE-2026-PoCs 一个由社区策划、验证的概念验证漏洞利用集合，涵盖2026年披露的CVE。 为什么有这个仓库 大多数CVE PoC集合分散在Twitter帖子、gist和失效的博客链接中。本仓库旨在成为2026年CVE PoC的单一、组织良好、积极维护的索引——包含一致的元数据、验证的参考来源以及清晰的贡献标准。 索引 CVE ID | CVE 描述| 受影响产品| 添加日期| POC 状态 ---|---|---|---|--- CVE-2026-9082| Drupal Drupal 核心中存在对 SQL 命令中特殊元素的不当处理（'SQL 注入'）漏洞，允许 SQL...

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress 插件批量利用工具 CVE-2026-8206 批量利用工具 – 针对 Kirki WordPress 插件（版本 ≤ 6.0.6）中的一个严重漏洞，允许未经身份验证的攻击者劫持密码重置链接并接管任何用户帐户，包括管理员。 漏洞概述 Kirki 插件暴露了一个未经身份验证的 REST 端点（/wp-json/KirkiComponentLibrary/v1/kirki-forgot-password）。由于缺少权限检查和不正确的电子邮件验证，攻击者可以： 为任何有效用户名请求密码重置...

CVE-2026-8206

CVE-2026-8206 CVE-2026-8206 Exploit de toma de control de cuenta no autenticada del plugin Kirki...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Kirki versions = 6.2.0...

CVE-2026-17037

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-76028

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-17037

CVE-2026-17037 affects the Kirki WordPress plugin (Freeform Page Builder, Website Builder & Customizer) in all versions up to and including 6.2.0 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping in the comment parameter. Beca...

CVE-2026-17037 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-17037 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-89812

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

kirki-wordpress-account-security-assessment

CVE-2026-8206 - Kirki WordPress 插件未授权账户接管 顾问式网络安全报告 针对 Kirki WordPress 账户安全风险的专业漏洞评估报告，包含技术影响、修复及缓解策略。 📍 报告快照 字段| 详情 ---|--- 报告类型| 漏洞评估报告 参与背景| 安全研究 主要关注点| WordPress / 内部服务 受众| 安全团队、工程团队、招聘经理 输出风格| 执行摘要、技术分析、业务影响、修复路线图 发布状态| 已脱敏，用于公开作品集审查 !IMPORTANT 本报告已特意脱敏，以便公开发布到...

CVE-2026-8206

CVE-2026-8206 Vulnerabilidad: Toma de control de cuenta no autenticada — Secuestro del correo de restablecimiento de contraseña en Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRÍTICA Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Resumen CVE-2026-8206 es una vulnerabilidad de Toma de control...

CVE-2026-84222

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

EUVD-2026-74716

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222

CVE-2026-84222 affects the Kirki WordPress plugin versions 6.2.1 through 6.2.5 . The plugin fails to verify whether the requester is authorized to read a post before rendering and returning its content via the kirki_data parameter. This allows unauthenticated users to retrieve the content of non-...

WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.1-6.2.5...

WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Kirki versions 6.2.1-6.2.5...

CVE-2026-8206-Lab

CVE-2026-8206 - Kirki 帐户接管实验环境 用于演示 Kirki WordPress 插件中 CVE-2026-8206 的本地 Docker 实验环境。 此仓库对比了真实 Kirki 插件的两个版本： vuln：Kirki 6.0.6 patched：Kirki 6.0.7 实验环境仅在本地运行，将 WordPress 服务绑定到 127.0.0.1。 PoC 的危害最小化：它请求一个密码重置，并验证实验环境内捕获的电子邮件收件人。它不会 更改任何密码。 摘要 CVE-2026-8206 是 Kirki 版本 6.0.0 至 6.0.6...