rootpwn

medium · CVSS v3 6.8 · EPSS 0.00152

CVE-2026-84223

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, all…

Description

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

Scores

Severity
medium
CVSS v2
5
CVSS v3
6.8
CVSS v4
—
EPSS
0.00152

← All CVEs

Related CVEs

medium

CVE-2026-94032

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-87840

The Tripzzy WordPress plugin before version 1.5.1 fails to enforce capability checks on booking‑management actions, exposing them to unauthenticated users via a token that any visitor can obtain. This flaw allows attackers to modify booking contents, totals, and notes without authorization. The vulnerability can lead to unauthorized data manipulation on affected WordPress sites.

View analysis

medium

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

View analysis