What is GHSA-xg2c-9mhj-9pvj?

GHSA-xg2c-9mhj-9pvj is a security advisory published by GitHub Security Advisories with Medium severity. The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body...

Which CVE IDs does GHSA-xg2c-9mhj-9pvj cover?

GHSA-xg2c-9mhj-9pvj covers the following CVE IDs: CVE-2026-12724. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xg2c-9mhj-9pvj?

GHSA-xg2c-9mhj-9pvj has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-xg2c-9mhj-9pvjMediumCVSS 4.3

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-12724 →

📋 Description

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12724
https://wpscan.com/vulnerability/6c2d4489-de82-472d-a5f7-dc01b305fdd0
https://github.com/advisories/GHSA-xg2c-9mhj-9pvj