Plugin icon

Kirki – Freeform Page Builder, Website Builder & Customizer

kirki

Vulnerabilities:

21

Last Updated:

August 19, 2026

Active Installs:

500000

Published
Title
Fixed in
CVSS
Published
2026-08-18
Title
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
Fixed in
Fixed in 6.2.3
CVSS
6.8 (medium)
Published
2026-08-15
Title
Kirki < 6.2.0 - Subscriber+ Sensitive User Data Disclosure via 'context' Parameter
Fixed in
Fixed in 6.2.0
CVSS
4.3 (medium)
Published
2026-08-15
Title
Kirki < 6.2.0 - Editor+ Arbitrary File Read via 'data' Parameter
Fixed in
Fixed in 6.2.0
CVSS
6.8 (medium)
Published
2026-08-10
Title
Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions
Fixed in
Fixed in 6.2.1
CVSS
6.5 (medium)
Published
2026-08-10
Title
Kirki < 6.2.1 - Contributor+ Stored XSS via post_meta Shortcode
Fixed in
Fixed in 6.2.1
CVSS
5.5 (medium)
Published
2026-07-31
Title
Kirki < 6.1.0 - Editor+ Arbitrary File Write via Zip Slip
Fixed in
Fixed in 6.1.0
CVSS
7.2 (high)
Published
2026-07-23
Title
Kirki < 6.1.0 - Unauthenticated Sensitive Data Disclosure via context Parameter
Fixed in
Fixed in 6.1.0
CVSS
5.3 (medium)
Published
2026-07-16
Title
Kirki < 6.0.14 - Editor+ Path Traversal to Arbitrary Directory Deletion via family
Fixed in
Fixed in 6.0.14
CVSS
4.9 (medium)
Published
2026-07-14
Title
Kirki < 6.0.13 - Unauthenticated SQL Injection
Fixed in
Fixed in 6.0.13
CVSS
8.6 (high)
Published
2026-07-14
Title
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 6.0.13
CVSS
7.5 (high)
Published
2026-07-06
Title
Kirki < 6.2.1 - Unauthenticated Missing Authorization
Fixed in
Fixed in 6.2.1
CVSS
5.3 (medium)
Published
2026-07-06
Title
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.12 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 6.0.12
CVSS
7.2 (high)
Published
2026-07-01
Title
Kirki < 6.0.12 - Unauthenticated Arbitrary Email Content Injection via emailBody and emailSubject Parameters
Fixed in
Fixed in 6.0.12
CVSS
5.3 (medium)
Published
2026-07-01
Title
Kirki < 6.0.12 - Unauthenticated Sensitive Data Exposure via kirki_post_apis_nopriv AJAX Action
Fixed in
Fixed in 6.0.12
CVSS
5.3 (medium)
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password
Fixed in
Fixed in 6.0.12
CVSS
4.3 (medium)
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
Fixed in
Fixed in 6.0.12
CVSS
n/a
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
Fixed in
Fixed in 6.0.12
CVSS
5.3 (medium)
Published
2026-06-26
Title
Kirki < 6.0.12 - Subscriber+ Server-Side Request Forgery
Fixed in
Fixed in 6.0.12
CVSS
6.4 (medium)
Published
2026-06-01
Title
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Fixed in
Fixed in 6.0.7
CVSS
9.8 (critical)
Published
2026-05-19
Title
Kirki < 6.0.7 - Subscriber+ Sensitive Data Exposure via kirki_wp_admin_get_apis Action
Fixed in
Fixed in 6.0.7
CVSS
4.3 (medium)
Published
2026-05-19
Title
Kirki < 6.0.7 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Fixed in
Fixed in 6.0.7
CVSS
6.5 (medium)