CVE-2026-84220

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

CVE-2026-84220 Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

EUVD-2026-95576

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

CVE-2026-84220

The Kirki WordPress plugin prior to version 6.3.2 is vulnerable to unauthenticated arbitrary shortcode execution . The issue occurs because the plugin fails to prevent the execution of shortcodes contained within comments when they are rendered, and it displays these comments regardless of their ...