A vulnerability, which was classified as critical , was found in Kirki Plugin up to 6.2.0 on WordPress. The impacted element is an unknown function of the component Shortcode Execution . Executing a manipulation can lead to injection. This vulnerability appears as CVE-2026-16747 . The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.