Plugin icon

Kirki – Freeform Page Builder, Website Builder & Customizer

kirki

Vulnerabilities:

3

Last Updated:

June 24, 2026

Active Installs:

500000

Published
Title
Fixed in
CVSS
Published
2026-06-01
Title
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Fixed in
Fixed in 6.0.7
CVSS
9.8 (critical)
Published
2026-05-19
Title
Kirki < 6.0.7 - Subscriber+ Sensitive Data Exposure via kirki_wp_admin_get_apis Action
Fixed in
Fixed in 6.0.7
CVSS
4.3 (medium)
Published
2026-05-19
Title
Kirki < 6.0.7 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Fixed in
Fixed in 6.0.7
CVSS
6.5 (medium)