What is the CVSS score of CVE-2026-12724?

CVE-2026-12724 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-12724?

Yes, a public proof-of-concept exploit is available for CVE-2026-12724. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-12724?

Yes, a patch is available for CVE-2026-12724. Update the affected software to the latest version immediately.

Kirki WordPress Plugin CVE-2026-12724

EUVD-2026-45883 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-20 WPScan

GHSA-xg2c-9mhj-9pvj

WordPress Code Injection Kirki Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible with no authentication required; UI:R reflects mandatory victim email interaction; integrity impact is limited to injected email content with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:33 vuln.today

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 20, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.

AnalysisAI

HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into password-reset emails delivered to registered site users, enabling targeted phishing from a trusted site domain. The flaw affects all Kirki versions below 6.0.12 and requires no authentication to trigger, though successful exploitation depends on the target user interacting with the malicious email. A publicly available POC exists per WPScan; the vulnerability is not currently listed in CISA KEV, and the 0.10% EPSS score (1st percentile) indicates minimal observed automated exploitation.

Technical ContextAI

Kirki is a widely-used WordPress customizer framework plugin that extends the WordPress Theme Customization API. The affected component is the plugin's password-reset email functionality, which accepts user-controlled values for the email subject and body in HTTP requests and embeds them directly into the HTML email sent to the registered user - without applying sanitization or output escaping. CWE-345 (Insufficient Verification of Data Authenticity) describes the root cause: the application trusts and includes externally supplied data without verifying its authenticity or safely encoding it for the HTML email context. This allows injection of arbitrary HTML tags - such as anchor links, images, iframes, or form elements - that render in the recipient's email client. The CPE entry (cpe:2.3:a:unknown:kirki:*:*:*:*:*:*:*:*) indicates incomplete vendor metadata in NVD, though the EUVD and WPScan sources both confirm the affected range as Kirki 0 through below 6.0.12.

RemediationAI

Update the Kirki WordPress plugin to version 6.0.12 or later, which contains the vendor-released patch addressing this HTML injection. The fix is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/6c2d4489-de82-472d-a5f7-dc01b305fdd0/. Site administrators should apply the update via the WordPress plugin dashboard immediately. If patching is not immediately feasible, consider disabling the Kirki password-reset email feature if it is non-essential to site operations - note this may affect user account recovery flows. A web application firewall rule stripping or rejecting HTML tags in the affected request parameters (email subject and body fields in password-reset requests) can serve as a compensating control, but may require tuning to avoid false positives on legitimate submissions. Notify registered users to treat unexpected password-reset emails with caution until the patch is applied.