PT-2026-108782 · WordPress · Kirki
CVSS v3.1
4.8
متوسطة
| المتجه | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Kirki WordPress plugin versions prior to 6.3.2
Description
The plugin fails to prevent the execution of shortcodes contained within comments during rendering. Additionally, it displays comments regardless of their moderation status. This allows unauthenticated visitors to execute shortcodes registered on the site and access private custom fields of the page being viewed.
Recommendations
Update the Kirki WordPress plugin to version 6.3.2 or later.
استغلال
إصلاح
Special Elements Injection
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Kirki