https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T10:37:46.796057+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-364241 EUVD-2026-364241 2026-10-07T10:37:46.844618+00:00 EUVD-2026-364241 https://cve.radiocsirt.org/vuln/fkie_cve-2026-84219 fkie_cve-2026-84219 2026-10-07T10:37:46.844661+00:00

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.

 https://cve.radiocsirt.org/vuln/ghsa-5jh7-hrj4-qc2f GHSA-5jh7-hrj4-qc2f 2026-10-07T10:37:46.844696+00:00

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.