CVE-2026-PoCs

💀 Exploit-Index: The Ultimate CVE Proof of Concept PoC & Exploit Database 150,000+ Verified Exploits & PoCs for Cybersecurity Research All In One Place Explore the Interactive Portal • View the JSON Index • Browse CVEs 📖 Abo...

CVE-2026-8206-Lab

CVE-2026-8206 - Kirki Account Takeover Lab Local Docker lab for demonstrating CVE-2026-8206 in the Kirki WordPress plugin. This repository compares the real Kirki plugin releases: vuln: Kirki 6.0.6 patched: Kirki 6.0.7 The lab is local-only and binds WordPress services to 127.0.0.1. The PoC is...

WordPress Kirki < 6.0.12 - Server-Side Request Forgery

Kirki WordPress plugin 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication. id: CVE-2026-13147 info: name: WordPress Kirki 6.0.12 - Server-Side...

EUVD-2026-113118

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0...

CVE-2026-42694

The Kirki WordPress plugin (versions

CVE-2026-8206

CVE-2026-8206 CVE-2026-8206 Kirki Plugin Unauthenticated Account Takeover Exploit...

kirki-wordpress-account-security-assessment

CVE-2026-8206 - Kirki WordPress Plugin Unauthenticated Account Takeover Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Kirki WordPress account security risk, including technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress Plugin Mass Exploit Mass exploitation tool for CVE-2026-8206 – a critical vulnerability in the Kirki WordPress plugin versions ≤ 6.0.6 that allows unauthenticated attackers to hijack password reset links and take over any user account, including administrators...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover vulnerability

Authenticated Subscriber+ PHP Object Injection to Administrator Account Takeover vulnerability discovered by daroo in WordPress Plugin Kirki versions = 6.2.5...

CVE-2026-75891

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirkipostapis AJAX dispatcher due to a missing capability check. This make...

EUVD-2026-110629

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirkipostapis AJAX dispatcher due to a missing capability check. This make...

CVE-2026-75891 Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirkipostapis AJAX dispatcher due to a missing capability check. This make...

CVE-2026-75891

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in versions up to and including 6.2.5 . The root cause is the deserialization of untrusted input within the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher due to a missing capability c...

PT-2026-125883

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki post apis AJAX dispatcher due to a missing capability check. This...

WordPress Kirki CVE-2026-8206 password-reset takeover

CVE-2026-8206: Kirki 6.0.0–6.0.6 CompLibFormHandler accepts an arbitrary email when resetting by username. POSTs to /wp-json/KirkiComponentLibrary/v1/kirki-forgot-password with X-WP-Element-Nonce, redirecting the victim's reset link to attackeremail. Does not complete the password change requires...

VulnCheck KEV: CVE-2026-57727

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Kirki versions = 6.3.2...

CVE-2026-107762

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-104734

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...