Koji

Koji has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Koji has a vendor fix available, so running the current release closes it.

All of these findings were reported by Trương Hữu Phúc (truonghuuphuc). Koji is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Koji vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-74020

Koji <= 2.2.1 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records


2026-08-19 00:00	Koji <= 2.2.1 - Missing Authorization Koji <= 2.2.1	`CVE-2026-74020`	5.3 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes

Showing 1–1 of 1 reports

Latestv2.2.2

Koji

Author

Anders Norén

4.9(11)

98/100

Last Updated

2026-08-26 (2mo ago)

Active Installs

1,000+

Downloads

116,283

Requires WP

Requires PHP

5.4+

Created

2018-10-05 (8y ago)

Koji is a clean and lightweight theme for bloggers. It features a masonry grid on the archive pages, a beautiful and minimal design, Block Editor/Gutenberg support, widget areas in the sidebar and the footer, infinite scroll loading that can be set to load more posts on button click or when the visitor reaches the bottom of the page, settings for what post meta to display on archive pages and on single posts, icon links to social media pages, custom logo support, a search overlay that can be accessed from any page, and much more. Demo: https://koji.andersnoren.se