EUVD-2026-45883
GHSA-xg2c-9mhj-9pvj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-accessible with no authentication required; UI:R reflects mandatory victim email interaction; integrity impact is limited to injected email content with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
AnalysisAI
HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into password-reset emails delivered to registered site users, enabling targeted phishing from a trusted site domain. The flaw affects all Kirki versions below 6.0.12 and requires no authentication to trigger, though successful exploitation depends on the target user interacting with the malicious email. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to have the Kirki plugin installed and active in a version below 6.0.12, with the plugin's password-reset email functionality enabled (default behavior). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) correctly captures the limited direct technical impact: no confidentiality breach, no code execution, no availability disruption - only injected HTML content delivered via email. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a password-reset request to a vulnerable WordPress site, injecting an HTML anchor tag or fraudulent login form into the email subject or body parameter - for example, embedding a link redirecting to an attacker-controlled credential-harvesting page styled to mimic the legitimate site. The target registered user receives this email from the site's own trusted sending domain, increasing the likelihood of interaction, and may submit credentials to the attacker's infrastructure. … |
| Remediation | Update the Kirki WordPress plugin to version 6.0.12 or later, which contains the vendor-released patch addressing this HTML injection. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attack
We need to produce a JSON object with specified fields. Let's gather the data: CVE-2026-65436, description: Editor Arbit
Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attack
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today