Kirki Vulnerabilities

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 6.2.1. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for unauthenticated attackers to execute arbitrary code on...

CVSS:

9.8

Affected:

up to 6.2.1

Fixed in:

6.2.1

Disclosed:

Aug 24, 2026

CVE-2026-16747 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 6.2.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to in...

CVSS:

4.4

Affected:

up to 6.2.3

Fixed in:

6.2.3

Disclosed:

Aug 21, 2026

CVE-2026-74992 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.2.4. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVSS:

7.2

Affected:

up to 6.2.4

Fix:

No patched version reported

Disclosed:

Aug 18, 2026

CVE-2026-66629 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wit...

CVSS:

4.3

Affected:

up to 6.1.1

Fixed in:

6.2.0

Disclosed:

Aug 15, 2026

CVE-2026-18347 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitr...

CVSS:

4.9

Affected:

up to 6.1.1

Fixed in:

6.2.0

Disclosed:

Aug 15, 2026

CVE-2026-17604 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with C...

CVSS:

6.4

Affected:

up to 6.2.0

Fixed in:

6.2.1

Disclosed:

Aug 10, 2026

CVE-2026-16974 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to 6.0.13 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable softwar...

CVSS:

8.1

Affected:

up to 6.0.13

Fixed in:

6.0.13

Disclosed:

Aug 4, 2026

CVE-2026-12720 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files...

CVSS:

4.9

Affected:

up to 6.0.13

Fixed in:

6.1.0

Disclosed:

Jul 31, 2026

CVE-2026-15601 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read...

CVSS:

5.3

Affected:

up to 6.0.14

Fixed in:

6.1.0

Disclosed:

Jul 23, 2026

CVE-2026-13464 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on th...

CVSS:

4.9

Affected:

up to 6.0.13

Fixed in:

6.0.14

Disclosed:

Jul 16, 2026

CVE-2026-15457 on NVD →

The Kirki plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alre...

CVSS:

7.5

Affected:

up to 6.0.12

Fixed in:

6.0.13

Disclosed:

Jul 14, 2026

CVE-2026-12721 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.0.12 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vu...

CVSS:

8.1

Affected:

up to 6.0.12

Fixed in:

6.0.13

Disclosed:

Jul 6, 2026

CVE-2026-57724 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticate...

CVSS:

7.5

Affected:

up to 6.0.12

Fixed in:

6.0.13

Disclosed:

Jul 6, 2026

CVE-2026-57726 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p...

CVSS:

7.2

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jul 6, 2026

CVE-2026-57725 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.2.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 6.2.0

Fixed in:

6.2.1

Disclosed:

Jul 6, 2026

CVE-2026-57727 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any...

CVSS:

5.3

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jul 1, 2026

CVE-2026-12122 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers t...

CVSS:

5.3

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jul 1, 2026

CVE-2026-12472 on NVD →

The Kirki plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.0.11. This is due to missing authentication and ownership verification when processing a user-supplied comment_id in the comment edit path of the REST API endpoint. This makes it possible for unauthentic...

CVSS:

5.3

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jun 30, 2026

CVE-2026-57680 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can...

CVSS:

7.2

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jun 29, 2026

CVE-2026-13147 on NVD →

The Kirki plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jun 29, 2026

CVE-2026-12723 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to inject HTML in password reset emails.

CVSS:

5.3

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jun 29, 2026

CVE-2026-12724 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originat...

CVSS:

6.4

Affected:

up to 6.0.11

Fixed in:

6.0.12

Disclosed:

Jun 26, 2026

CVE-2026-57627 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for...

CVSS:

9.8

Affected:

6.0.0 – 6.0.6

Fixed in:

6.0.7

Disclosed:

Jun 1, 2026

CVE-2026-8206 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attack...

CVSS:

7.5

Affected:

up to 6.0.6

Fixed in:

6.0.7

Disclosed:

May 19, 2026

CVE-2026-8073 on NVD →

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wit...

CVSS:

6.5

Affected:

up to 6.0.6

Fixed in:

6.0.7

Disclosed:

May 19, 2026

CVE-2026-8096 on NVD →