KF
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
19
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 1High 6Medium 12Low 0
Watch
Add Kirki – Freeform Page Builder, Website Builder & Customizer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8206 | 9.8 | Jun 2 | Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' Affected: 6.0.0 through 6.0.6 |
| CVE-2026-75891 New | 8.8 | Oct 27 | Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint Affected: through 6.2.5 |
| CVE-2026-107762 | 7.5 | Oct 17 | Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter Affected: through 6.3.2 |
| CVE-2026-8073 | 7.5 | May 19 | Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP Affected: through 6.0.6 |
| CVE-2026-104734 | 7.2 | Oct 17 | Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import Affected: through 6.3.2 |
| CVE-2026-102173 | 7.2 | Oct 7 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata Affected: through 6.3.1 |
| CVE-2026-17037 | 7.2 | Sep 11 | Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter Affected: through 6.2.0 |
| CVE-2026-8096 | 6.5 | May 19 | Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action Affected: through 6.0.6 |
| CVE-2026-14572 | 6.4 | Oct 15 | Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content Affected: through 6.2.0 |
| CVE-2026-16974 | 6.4 | Aug 11 | Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode Affected: through 6.2.0 |
| CVE-2026-102291 | 5.4 | Oct 10 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' Affected: through 6.3.1 |
| CVE-2026-18335 | 5.4 | Sep 24 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter Affected: through 6.2.0 |
| CVE-2026-13464 | 5.3 | Jul 24 | Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter Affected: through 6.0.14 |
| CVE-2026-12472 | 5.3 | Jul 2 | Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters Affected: through 6.0.11 |
| CVE-2026-12122 | 5.3 | Jul 2 | Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action Affected: through 6.0.11 |
| CVE-2026-17604 | 4.9 | Aug 16 | Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter Affected: through 6.1.1 |
| CVE-2026-15601 | 4.9 | Aug 1 | Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) Affected: through 6.0.13 |
| CVE-2026-15457 | 4.9 | Jul 17 | Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter Affected: through 6.0.13 |
| CVE-2026-18347 | 4.3 | Aug 16 | Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter Affected: through 6.1.1 |
Showing 19