CVE-2026-84220 — Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection

CVE-2026-84220

Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection PUBLISHED

Description (CNA)

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.

Affected (CNA)

Vendor / product	Versions
Unknown / Kirki	affected 0 before 6.3.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e5cfd004-dd57-4d42-858c-fbb9b9e320f6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.