Vulnerability · Published Oct 9, 2026 · Assigned by WPScan
CVE-2026-84220Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection
Medium 4.8
In plain English
A medium-severity injection in Kirki from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.1%top 96.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
Affected products (as reported)
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/e5cfd004-dd57-4d42-858c-fbb9b9e320f6/ exploit, vdb-entry, technical-description