Skip to main content

Kirki EUVDEUVD-2026-49231

| CVE-2026-65436 MEDIUM
Path Traversal (CWE-22)
2026-07-27 Patchstack GHSA-q7jw-4655-mjq2
Path Traversal Kirki
6.8
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.8 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jul 27, 2026 - 15:06 vuln.today

DescriptionCVE.org

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

AnalysisAI

We need to produce a JSON object with specified fields. Let's gather the data: CVE-2026-65436, description: Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Kirki

View all
CVE-2026-13147 CRITICAL POC
9.1 Jul 20

Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the s
CVE-2026-12721 HIGH POC
8.6 Jul 31

SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbit
CVE-2026-12720 HIGH POC
7.5 Jul 31

PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users

CVE-2026-57724 CRITICAL
9.8 Jul 13

Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to a
CVE-2026-12723 MEDIUM POC
5.3 Jul 20

Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to o
CVE-2026-57726 CRITICAL
9.3 Jul 13

Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets r
CVE-2026-12724 MEDIUM POC
4.3 Jul 20

HTML injection in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to embed arbitrary HTML into
CVE-2026-57727 HIGH
7.5 Jul 13

Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows r
CVE-2026-57725 HIGH
7.1 Jul 13

Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attack
CVE-2026-57680 MEDIUM
6.5 Jul 02

Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attack

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2023-47246 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2023-47246 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8

Share

EUVD-2026-49231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy