176 matches found
CVE-2026-8206-Lab
CVE-2026-8206 - Laboratório de Assunção de Conta Kirki Laboratório Docker local para demonstrar a CVE-2026-8206 no plugin Kirki para WordPress. Este repositório compara as versões reais do plugin Kirki: vuln: Kirki 6.0.6 patched: Kirki 6.0.7 O laboratório é apenas local e vincula os serviços...
WordPress Kirki < 6.0.12 - Server-Side Request Forgery
Kirki WordPress plugin 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication. id: CVE-2026-13147 info: name: WordPress Kirki 6.0.12 - Server-Side...
CVE-2026-8206
CVE-2026-8206 भेद्यता: किर्की कस्टमाइज़र फ्रेमवर्क में बिना प्रमाणीकरण के खाता अधिग्रहण — पासवर्ड रीसेट ईमेल अपहरण CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. अवलोकन CVE-2026-8206, Kirki Customizer Framework में एक बिना प्रमाणीकरण के खाता अधिग्रहण Unauthenticated...
CVE-2026-8206
CVE-2026-8206 - Exploração em Massa do Plugin WordPress Kirki Ferramenta de exploração em massa para CVE-2026-8206 – uma vulnerabilidade crítica no plugin Kirki WordPress versões ≤ 6.0.6 que permite que atacantes não autenticados sequestrem links de redefinição de senha e assumam o controle de...
CVE-2026-PoCs
CVE-2026-PoCs Una raccolta curata dalla community e verificata di exploit Proof-of-Concept per le CVE divulgate nel 2026. Perché questo repo La maggior parte delle raccolte di PoC per CVE sono sparse tra thread di Twitter, gist e link di blog morti. Questo repo mira a essere l'indice unico, ben...
CVE-2026-8206
CVE-2026-8206 CVE-2026-8206 Exploit di acquisizione account non autenticata del plugin Kirki...
CVE-2026-77754
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
WordPress Kirki plugin < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure vulnerability
Unauthenticated User and Comment Author Email Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Kirki versions 6.0.14...
EUVD-2026-66286
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
CVE-2026-77754 Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
CVE-2026-77754
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings...
WordPress Kirki plugin < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability
Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability discovered by Jakub Herman in WordPress Plugin Kirki versions 6.2.1...
kirki-wordpress-account-security-assessment
CVE-2026-8206 - Acquisizione non autenticata di account nel plugin WordPress Kirki Report di cybersecurity in stile consulenziale Report professionale di valutazione delle vulnerabilità per il rischio di sicurezza degli account WordPress Kirki, che include impatto tecnico, rimedio e strategia di...
CVE-2026-74992
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...
EUVD-2026-63206
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...
CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...
CVE-2026-74992
The Kirki WordPress plugin before 6.2.3 fails to validate archive contents and clean up extracted files during font zip uploads by Editor-role users, allowing arbitrary file placement in a web-accessible directory. This enables Stored XSS and remote code execution on some server configurations. N...
CVE-2026-66629
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...