KF
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
19
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 1High 6Medium 12Low 0
Watch
Add Kirki – Freeform Page Builder, Website Builder & Customizer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-75891 New | 8.8 | Oct 27 | Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint Affected: through 6.2.5 |
| CVE-2026-107762 | 7.5 | Oct 17 | Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter Affected: through 6.3.2 |
| CVE-2026-8073 | 7.5 | May 19 | Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP Affected: through 6.0.6 |
| CVE-2026-104734 | 7.2 | Oct 17 | Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import Affected: through 6.3.2 |
| CVE-2026-102173 | 7.2 | Oct 7 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata Affected: through 6.3.1 |
| CVE-2026-17037 | 7.2 | Sep 11 | Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter Affected: through 6.2.0 |
Showing 6