Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities

Product

Kirki – Freeform Page Builder, Website Builder & Customizer

by themeum · last CVE Oct 27, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities19 In the news1 Timeline

Severity mix

Critical 1High 6Medium 12Low 0

Severity

All severities19 Critical1 High6 Medium12 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Kirki – Freeform Page Builder, Website Builder & Customizer to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-8096	6.5	0%	May 19	Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action Affected: through 6.0.6
CVE-2026-14572	6.4	0%	Oct 15	Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content Affected: through 6.2.0
CVE-2026-16974	6.4	0%	Aug 11	Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode Affected: through 6.2.0
CVE-2026-102291	5.4	0%	Oct 10	Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' Affected: through 6.3.1
CVE-2026-18335	5.4	0%	Sep 24	Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter Affected: through 6.2.0
CVE-2026-13464	5.3	0%	Jul 24	Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter Affected: through 6.0.14
CVE-2026-12472	5.3	1%	Jul 2	Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters Affected: through 6.0.11
CVE-2026-12122	5.3	0%	Jul 2	Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action Affected: through 6.0.11
CVE-2026-17604	4.9	1%	Aug 16	Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter Affected: through 6.1.1
CVE-2026-15601	4.9	1%	Aug 1	Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) Affected: through 6.0.13
CVE-2026-15457	4.9	1%	Jul 17	Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter Affected: through 6.0.13
CVE-2026-18347	4.3	1%	Aug 16	Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter Affected: through 6.1.1