https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-26T11:19:28.436100+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-84219 fkie_cve-2026-84219 2026-10-26T11:19:28.437445+00:00

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.

 https://db.gcve.eu/vuln/ghsa-5jh7-hrj4-qc2f GHSA-5jh7-hrj4-qc2f 2026-10-26T11:19:28.437504+00:00

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.