WordPress Plugin Vulnerabilities

Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.12 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
kirki
Fixed in 6.0.12

References

CVE
CVE-2026-57725
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/35db7137-aba0-4299-ad8a-c650d6db5199

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
VanTastic
Verified
No
WPVDB ID
10533208-5b69-4cfa-825a-fa35aebceefa

Timeline

Publicly Published
2026-07-06 (about 1 month ago)
Added
2026-07-16 (about 1 month ago)
Last Updated
2026-07-16 (about 1 month ago)

Other

Published
Title
Published
2015-02-19
Title
Easy Social Icons <= 1.2.2 - Stored XSS & CSRF
Published
2023-10-16
Title
WooCommerce PDF Invoice Builder < 1.2.104 - Reflected XSS
Published
2025-05-30
Title
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder < 5.11.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Published
2025-01-14
Title
GSheetConnector for Forminator Forms < 1.0.13 - Reflected XSS
Published
2024-02-20
Title
Beaver Builder < 2.7.4.3 - Contributor+ Stored XSS via Icon Widget