CVE-2026-75891

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in versions up to and including 6.2.5 . The root cause is the deserialization of untrusted input within the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher due to a missing capability c...

EUVD-2026-110629

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirkipostapis AJAX dispatcher due to a missing capability check. This make...