Kit has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 5.9 (medium).
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Weakness classes
Products
- convertkit 1
- convertkit-for-woocommerce 1
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-110880Medium· 6.5WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability36CVE-2026-105421Medium· 5.3Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooC…29
Kit vulnerabilities
CVEs affecting Kit, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-110880Medium· 6.5WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.
▾ SunlitKit · convertkitEPSS 0.24%via CVEORG
CVE-2026-105421Medium· 5.3Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooC…
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooC…
▾ SunlitKit · convertkit-for-woocommerceEPSS 0.18%via NVD