CVE-2026-12721 — Kirki < 6.0.13 - Unauthenticated SQL Injection
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attac…
Published: 2026-07-31 · CVSS: 8.6 · CVSS 3.1
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7