CVE-2026-84221 — Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append a…
Published: 2026-09-05 · CVSS: 6.8 · CVSS 3.1
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7