Plugin icon

Kirki – Freeform Page Builder, Website Builder & Customizer

kirki

Vulnerabilities:

29

Last Updated:

September 15, 2026

Active Installs:

500000

Published
Title
Fixed in
CVSS
Published
2026-09-18
Title
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
Fixed in
Fixed in 6.3.1
CVSS
6.8 (medium)
Published
2026-09-10
Title
Kirki < 6.2.1 - Unauthenticated Stored XSS via 'comment' Parameter
Fixed in
Fixed in 6.2.1
CVSS
7.2 (high)
Published
2026-09-07
Title
Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
Fixed in
Fixed in 6.3.0
CVSS
5.3 (medium)
Published
2026-09-04
Title
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
Fixed in
Fixed in 6.3.0
CVSS
7.5 (high)
Published
2026-09-03
Title
Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
Fixed in
Fixed in 6.3.0
CVSS
6.8 (medium)
Published
2026-09-03
Title
Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR
Fixed in
Fixed in 6.3.0
CVSS
2.2 (low)
Published
2026-08-24
Title
Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis
Fixed in
Fixed in 6.0.14
CVSS
5.3 (medium)
Published
2026-08-18
Title
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
Fixed in
Fixed in 6.2.3
CVSS
6.8 (medium)
Published
2026-08-18
Title
Kirki < 6.2.5 - Unauthenticated Stored XSS
Fixed in
Fixed in 6.2.5
CVSS
7.2 (high)
Published
2026-08-15
Title
Kirki < 6.2.0 - Subscriber+ Sensitive User Data Disclosure via 'context' Parameter
Fixed in
Fixed in 6.2.0
CVSS
4.3 (medium)
Published
2026-08-15
Title
Kirki < 6.2.0 - Editor+ Arbitrary File Read via 'data' Parameter
Fixed in
Fixed in 6.2.0
CVSS
6.8 (medium)
Published
2026-08-10
Title
Kirki < 6.2.1 - Contributor+ Stored XSS via post_meta Shortcode
Fixed in
Fixed in 6.2.1
CVSS
5.5 (medium)
Published
2026-08-10
Title
Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions
Fixed in
Fixed in 6.2.1
CVSS
6.5 (medium)
Published
2026-07-31
Title
Kirki < 6.1.0 - Editor+ Arbitrary File Write via Zip Slip
Fixed in
Fixed in 6.1.0
CVSS
7.2 (high)
Published
2026-07-23
Title
Kirki < 6.1.0 - Unauthenticated Sensitive Data Disclosure via context Parameter
Fixed in
Fixed in 6.1.0
CVSS
5.3 (medium)
Published
2026-07-16
Title
Kirki < 6.0.14 - Editor+ Path Traversal to Arbitrary Directory Deletion via family
Fixed in
Fixed in 6.0.14
CVSS
4.9 (medium)
Published
2026-07-14
Title
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 6.0.13
CVSS
7.5 (high)
Published
2026-07-14
Title
Kirki < 6.0.13 - Unauthenticated SQL Injection
Fixed in
Fixed in 6.0.13
CVSS
8.6 (high)
Published
2026-07-06
Title
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.12 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 6.0.12
CVSS
7.2 (high)
Published
2026-07-06
Title
Kirki < 6.2.1 - Unauthenticated Missing Authorization
Fixed in
Fixed in 6.2.1
CVSS
5.3 (medium)
Published
2026-07-01
Title
Kirki < 6.0.12 - Unauthenticated Sensitive Data Exposure via kirki_post_apis_nopriv AJAX Action
Fixed in
Fixed in 6.0.12
CVSS
5.3 (medium)
Published
2026-07-01
Title
Kirki < 6.0.12 - Unauthenticated Arbitrary Email Content Injection via emailBody and emailSubject Parameters
Fixed in
Fixed in 6.0.12
CVSS
5.3 (medium)
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library
Fixed in
Fixed in 6.0.12
CVSS
5.3 (medium)
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password
Fixed in
Fixed in 6.0.12
CVSS
4.3 (medium)
Published
2026-06-29
Title
Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis
Fixed in
Fixed in 6.0.12
CVSS
n/a
Published
2026-06-26
Title
Kirki < 6.0.12 - Subscriber+ Server-Side Request Forgery
Fixed in
Fixed in 6.0.12
CVSS
6.4 (medium)
Published
2026-06-01
Title
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Fixed in
Fixed in 6.0.7
CVSS
9.8 (critical)
Published
2026-05-19
Title
Kirki < 6.0.7 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Fixed in
Fixed in 6.0.7
CVSS
6.5 (medium)
Published
2026-05-19
Title
Kirki < 6.0.7 - Subscriber+ Sensitive Data Exposure via kirki_wp_admin_get_apis Action
Fixed in
Fixed in 6.0.7
CVSS
4.3 (medium)