{"metadata": {"vulnerability": "CVE-2026-102291", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-28T20:34:15.636Z", "date_only": false, "value": "2026-09-28T20:34:15.636Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-102291", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-28T20:50:31Z", "date_only": false, "value": "2026-09-28T20:50:31.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-102291", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-09T18:47:02Z", "date_only": false, "value": "2026-10-09T18:47:02.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-102291", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-10T07:41:47.748Z", "date_only": false, "value": "2026-10-10T07:41:47.748Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102291", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-10T07:41:47.748Z", "date_only": false, "value": "2026-10-10T07:41:47.748Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-102291", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T07:55:07.324Z", "date_only": false, "value": "2026-10-10T07:55:07.324507Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117415536665829736", "record": "CVE-2026-102291", "field": "creation_timestamp", "uuid": "a29d61e8-a978-4189-ae52-91c2f82541fc", "content": "CVE-2026-102291 Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection \u2014 an ordinary team or member-directory page \u2014 the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field.\nhttps://www.cve.org/CVERecord?id=CVE-2026-102291https://www.wordfence.com/threat-intel/vulnerabilities/id/bed93040-a843-417e-89b4-5ab3cba788aa?source=cvehttps://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/TheFrontend.php#L144https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L408https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L308https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Frontend/Preview/Utils.php#L334https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/HelperFunctions.php#L1117https://plugins.trac.wordpress.org/browser/kirki/tags/6.3.1/includes/Manager/PluginShortcode.php#L40https://plugins.trac.wordpress.org/changeset?reponame=&new=3718900%40kirki%2Ftags%2F6.3.2&old=3697265%40kirki%2Ftags%2F6.3.1#wordpress #themeum #Kirki\u2013FreeformPageBuilder,WebsiteBuilder&Customizer#CVE_2026_102291#bot", "url": "https://infosec.exchange/users/cve/statuses/117415536665829736"}, {"timestamp": "2026-10-10T08:17:03Z", "date_only": false, "value": "2026-10-10T08:17:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V9XH-P885-R83G", "record": "GHSA-V9XH-P885-R83G", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-10T08:17:03.490Z", "date_only": false, "value": "2026-10-10T08:17:03.490", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102291", "record": "FKIE_CVE-2026-102291", "field": "published"}, {"timestamp": "2026-10-10T09:30:28Z", "date_only": false, "value": "2026-10-10T09:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V9XH-P885-R83G", "record": "GHSA-V9XH-P885-R83G", "field": "published"}, {"timestamp": "2026-10-10T09:30:28Z", "date_only": false, "value": "2026-10-10T09:30:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V9XH-P885-R83G", "record": "GHSA-V9XH-P885-R83G", "field": "modified"}, {"timestamp": "2026-10-11T16:37:18.881Z", "date_only": false, "value": "2026-10-11T16:37:18.881293Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102291", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-11T16:37:18.881Z", "date_only": false, "value": "2026-10-11T16:37:18.881293Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102291", "record": "FKIE_CVE-2026-102291", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-11T16:55:15.382Z", "date_only": false, "value": "2026-10-11T16:55:15.382Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-102291", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T16:55:15.382Z", "date_only": false, "value": "2026-10-11T16:55:15.382Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102291", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:30:21.620Z", "date_only": false, "value": "2026-10-13T13:30:21.620", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102291", "record": "FKIE_CVE-2026-102291", "field": "lastModified"}]}