https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:15:56.426539+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-323783 EUVD-2026-323783 2026-10-06T14:15:56.429227+00:00 EUVD-2026-323783 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8206 fkie_cve-2026-8206 2026-10-06T14:15:56.429259+00:00

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.

 https://cve.radiocsirt.org/vuln/ghsa-gr32-6rr4-7px2 GHSA-gr32-6rr4-7px2 2026-10-06T14:15:56.429294+00:00

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.