agentprime: themeum-kirki-freeform-page-builder-website-builder-customizerEvery new CVE for themeum-kirki-freeform-page-builder-website-builder-customizer.https://agentprime.io/CVE-2026-75891: Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpointhttps://agentprime.io/advisories/CVE-2026-75891/https://agentprime.io/advisories/CVE-2026-75891/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 06:40:42 GMTCVECVE-2026-104734: Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Importhttps://agentprime.io/advisories/CVE-2026-104734/https://agentprime.io/advisories/CVE-2026-104734/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 17 Oct 2026 02:31:05 GMTCVECVE-2026-107762: Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameterhttps://agentprime.io/advisories/CVE-2026-107762/https://agentprime.io/advisories/CVE-2026-107762/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 17 Oct 2026 02:31:05 GMTCVECVE-2026-14572: Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Contenthttps://agentprime.io/advisories/CVE-2026-14572/https://agentprime.io/advisories/CVE-2026-14572/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 04:26:51 GMTCVECVE-2026-102291: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'https://agentprime.io/advisories/CVE-2026-102291/https://agentprime.io/advisories/CVE-2026-102291/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Oct 2026 07:41:47 GMTCVECVE-2026-102173: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadatahttps://agentprime.io/advisories/CVE-2026-102173/https://agentprime.io/advisories/CVE-2026-102173/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 05:30:40 GMTCVECVE-2026-18335: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameterhttps://agentprime.io/advisories/CVE-2026-18335/https://agentprime.io/advisories/CVE-2026-18335/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 09:27:45 GMTCVECVE-2026-17037: Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameterhttps://agentprime.io/advisories/CVE-2026-17037/https://agentprime.io/advisories/CVE-2026-17037/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 09:27:20 GMTCVECVE-2026-18347: Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameterhttps://agentprime.io/advisories/CVE-2026-18347/https://agentprime.io/advisories/CVE-2026-18347/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 16 Aug 2026 06:38:09 GMTCVECVE-2026-17604: Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameterhttps://agentprime.io/advisories/CVE-2026-17604/https://agentprime.io/advisories/CVE-2026-17604/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 16 Aug 2026 06:38:09 GMTCVECVE-2026-16974: Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcodehttps://agentprime.io/advisories/CVE-2026-16974/https://agentprime.io/advisories/CVE-2026-16974/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 04:25:50 GMTCVECVE-2026-15601: Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)https://agentprime.io/advisories/CVE-2026-15601/https://agentprime.io/advisories/CVE-2026-15601/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 01 Aug 2026 07:49:46 GMTCVECVE-2026-13464: Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameterhttps://agentprime.io/advisories/CVE-2026-13464/https://agentprime.io/advisories/CVE-2026-13464/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Jul 2026 02:31:59 GMTCVECVE-2026-15457: Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameterhttps://agentprime.io/advisories/CVE-2026-15457/https://agentprime.io/advisories/CVE-2026-15457/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Jul 2026 03:43:40 GMTCVECVE-2026-12472: Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parametershttps://agentprime.io/advisories/CVE-2026-12472/https://agentprime.io/advisories/CVE-2026-12472/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 08:33:07 GMTCVECVE-2026-12122: Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Actionhttps://agentprime.io/advisories/CVE-2026-12122/https://agentprime.io/advisories/CVE-2026-12122/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 08:33:06 GMTCVECVE-2026-8206: Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'https://agentprime.io/advisories/CVE-2026-8206/https://agentprime.io/advisories/CVE-2026-8206/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 03:28:49 GMTCVEcriticalCVE-2026-8073: Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIPhttps://agentprime.io/advisories/CVE-2026-8073/https://agentprime.io/advisories/CVE-2026-8073/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 18:33:52 GMTCVECVE-2026-8096: Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Actionhttps://agentprime.io/advisories/CVE-2026-8096/https://agentprime.io/advisories/CVE-2026-8096/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 19 May 2026 18:33:51 GMTCVE