← back to popular plugins
wordfence / plugin · kirki

Kirki – Freeform Page Builder, Website Builder & Customizer

kirki
total installs
500,000
total vulns
39
critical
3
high
11
medium
25
low
0
latest vuln
—
patched
39
unpatched
0
avg time to patch
—
vulnerabilities (39)
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
medium ✓ patched
cve id CVE-2026-14572 ↗
cvss score 6.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Oct 14, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
medium ✓ patched
cve id CVE-2026-102291 ↗
cvss score 5.4
cwe CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
published Oct 9, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection — an ordinary team or member-directory page — the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field.
Kirki <= 6.3.1 - Unauthenticated Arbitrary Shortcode Execution
medium ✓ patched
cve id CVE-2026-84220 ↗
cvss score 6.5
cwe CWE-94: Improper Control of Generation of Code ('Code Injection')
published Oct 9, 2026
The Kirki plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 6.3.1. This is due to the use of do_shortcode() on user supplied input. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered on the site. The impact depends on which shortcodes the site has registered, so a site running a plugin whose shortcodes expose data or perform actions is affected more severely.
Kirki <= 6.3.1 - Authenticated (Editor+) Server-Side Request Forgery
medium ✓ patched
cve id CVE-2026-84224 ↗
cvss score 5.5
cwe CWE-918: Server-Side Request Forgery (SSRF)
published Oct 9, 2026
The Kirki plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.3.1. This makes it possible for authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
high ✓ patched
cve id CVE-2026-102173 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Oct 6, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution
critical ✓ patched
cve id CVE-2026-103065 ↗
cvss score 9.8
cwe CWE-94: Improper Control of Generation of Code ('Code Injection')
published Oct 1, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.3.1. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for unauthenticated attackers to execute arbitrary code on the server.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
medium ✓ patched
cve id CVE-2026-18335 ↗
cvss score 5.4
cwe CWE-918: Server-Side Request Forgery (SSRF)
published Sep 23, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
medium ✓ patched
cve id CVE-2026-84223 ↗
cvss score 6.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Sep 18, 2026
The Kirki plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 6.0.0 to 6.3.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
high ✓ patched
cve id CVE-2026-17037 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Sep 10, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Information Exposure
medium ✓ patched
cve id CVE-2026-84222 ↗
cvss score 5.3
cwe CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published Sep 9, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 6.2.1 through 6.2.5. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Stored Cross-Site Scripting
high ✓ patched
cve id CVE-2026-84219 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Sep 8, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 6.2.1 through 6.2.5. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
medium ✓ patched
cve id CVE-2026-84225 ↗
cvss score 4.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Sep 5, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 6.0.0 through 6.2.5. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom role-level access and above, to perform an unauthorized action.
Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Editor+) SQL Injection
medium ✓ patched
cve id CVE-2026-84221 ↗
cvss score 4.9
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Sep 5, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to SQL Injection in versions 6.0.0 through 6.2.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.14 - Missing Authorization
medium ✓ patched
cve id CVE-2026-77754 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Aug 26, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to unauthorized access in all versions up to 6.0.14. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.1 - Unauthenticated Remote Code Execution
critical ✓ patched
cve id CVE-2026-16747 ↗
cvss score 9.8
cwe CWE-94: Improper Control of Generation of Code ('Code Injection')
published Aug 24, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 6.2.1. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for unauthenticated attackers to execute arbitrary code on the server.
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
medium ✓ patched
cve id CVE-2026-74992 ↗
cvss score 4.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Aug 21, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 6.2.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting
high ✓ patched
cve id CVE-2026-66629 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Aug 18, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.2.4. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
medium ✓ patched
cve id CVE-2026-18347 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Aug 15, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.
Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
medium ✓ patched
cve id CVE-2026-17604 ↗
cvss score 4.9
cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published Aug 15, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
medium ✓ patched
cve id CVE-2026-16974 ↗
cvss score 6.4
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Aug 10, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection
high ✓ patched
cve id CVE-2026-12720 ↗
cvss score 8.1
cwe CWE-502: Deserialization of Untrusted Data
published Aug 4, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to 6.0.13 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
medium ✓ patched
cve id CVE-2026-15601 ↗
cvss score 4.9
cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published Jul 31, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
medium ✓ patched
cve id CVE-2026-13464 ↗
cvss score 5.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Jul 23, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
medium ✓ patched
cve id CVE-2026-15457 ↗
cvss score 4.9
cwe CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published Jul 16, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability. CVE-2026-65436 is likely a duplicate of this.
Kirki <= 6.0.12 - Unauthenticated SQL Injection
high ✓ patched
cve id CVE-2026-12721 ↗
cvss score 7.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Jul 14, 2026
The Kirki plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection
high ✓ patched
cve id CVE-2026-57726 ↗
cvss score 7.5
cwe CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published Jul 6, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Missing Authorization
medium ✓ patched
cve id CVE-2026-57727 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Jul 6, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.2.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting
high ✓ patched
cve id CVE-2026-57725 ↗
cvss score 7.2
cwe CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published Jul 6, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection
high ✓ patched
cve id CVE-2026-57724 ↗
cvss score 8.1
cwe CWE-502: Deserialization of Untrusted Data
published Jul 6, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.0.12 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
medium ✓ patched
cve id CVE-2026-12122 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Jul 1, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
medium ✓ patched
cve id CVE-2026-12472 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Jul 1, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
Kirki <= 6.0.11 - Unauthenticated Insecure Direct Object Reference
medium ✓ patched
cve id CVE-2026-57680 ↗
cvss score 5.3
cwe CWE-639: Authorization Bypass Through User-Controlled Key
published Jun 30, 2026
The Kirki plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.0.11. This is due to missing authentication and ownership verification when processing a user-supplied comment_id in the comment edit path of the REST API endpoint. This makes it possible for unauthenticated attackers to edit arbitrary comments by supplying a targeted comment ID, regardless of comment ownership.
Kirki <= 6.0.11 - Unauthenticated HTML Injection
medium ✓ patched
cve id CVE-2026-12724 ↗
cvss score 5.3
cwe CWE-20: Improper Input Validation
published Jun 29, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to inject HTML in password reset emails.
Kirki <= 6.0.11 - Unauthenticated Server-Side Request Forgery
high ✓ patched
cve id CVE-2026-13147 ↗
cvss score 7.2
cwe CWE-918: Server-Side Request Forgery (SSRF)
published Jun 29, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Kirki <= 6.0.11 - Missing Authorization
medium ✓ patched
cve id CVE-2026-12723 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Jun 29, 2026
The Kirki plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Authenticated (Subscriber+) Server-Side Request Forgery
medium ✓ patched
cve id CVE-2026-57627 ↗
cvss score 6.4
cwe CWE-918: Server-Side Request Forgery (SSRF)
published Jun 26, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
critical ✓ patched
cve id CVE-2026-8206 ↗
cvss score 9.8
cwe CWE-269: Improper Privilege Management
published Jun 1, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
high ✓ patched
cve id CVE-2026-8073 ↗
cvss score 7.5
cwe CWE-23: Relative Path Traversal
published May 19, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.
Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
medium ✓ patched
cve id CVE-2026-8096 ↗
cvss score 6.5
cwe CWE-862: Missing Authorization
published May 19, 2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.