What’s Vulnerable › Products
themeum Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Latest themeum Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities
- CVE-2026-75891 — Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint (CVSS 8.8)
- CVE-2026-107762 — Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter (CVSS 7.5)
- CVE-2026-104734 — Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import (CVSS 7.2)
- CVE-2026-14572 — Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content (CVSS 6.4)
- CVE-2026-102291 — Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' (CVSS 5.4)
- CVE-2026-102173 — Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata (CVSS 7.2)
- CVE-2026-18335 — Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter (CVSS 5.4)
- CVE-2026-17037 — Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter (CVSS 7.2)
- CVE-2026-18347 — Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter (CVSS 4.3)
- CVE-2026-17604 — Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter (CVSS 4.9)
- CVE-2026-16974 — Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode (CVSS 6.4)
- CVE-2026-15601 — Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) (CVSS 4.9)
- CVE-2026-13464 — Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter (CVSS 5.3)
- CVE-2026-15457 — Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter (CVSS 4.9)
- CVE-2026-12472 — Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters (CVSS 5.3)
- CVE-2026-12122 — Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action (CVSS 5.3)
- CVE-2026-8206 — Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' (CVSS 9.8)
- CVE-2026-8096 — Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action (CVSS 6.5)
- CVE-2026-8073 — Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP (CVSS 7.5)