Kirki.

Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL

• Kirki
• Server-side request forgery (SSRF)

Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection

• Kirki
• Other injection

Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload

• Kirki
• Cross-site scripting (XSS)

Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

• Kirki
• Information disclosure

Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

• Kirki
• Cross-site scripting (XSS)

Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR

• Kirki
• Broken access control

Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

• Kirki
• SQL injection

Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis

• Kirki
• Information disclosure

Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload

• Kirki
• Cross-site scripting (XSS)

Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions

• Kirki
• Other injection

Kirki < 6.0.13 - Unauthenticated SQL Injection

• Kirki
• SQL injection

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

• Kirki
• Insecure deserialization

Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

• Kirki

Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password

• Kirki
• CWE-345

Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library

• Kirki
• Broken access control