The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Kirki Plugin | — | Update kirki plugin to version 6.0.12, or a newer patched version | Jul 31, 2026 | Jun 29, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub