CVE-2026-12721

HighCVSS 8.6/10Last modified Aug 26, 2026

Description

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	Kirki	< 6.0.13

References

https://wpscan.com/vulnerability/4cba3900-9f29-4928-811c-163827358052/

Timeline

Published: Jul 31, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1272116.5MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST r CVE-2026-1272124.3Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated att CVE-2026-127228.2Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication CVE-2026-127235.3The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users CVE-2026-1272356.1A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Severa CVE-2026-1272365.4An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and Horizon. The ad-hoc CVE-2026-127244.3The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before includi CVE-2026-127255.9A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replie CVE-2026-127266.3A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request CVE-2026-127274.3IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing spe CVE-2026-1272734.3A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault o CVE-2026-1272743.7A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword.