Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 289,273 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · kirki
Kirki
43 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 27, 2026Kirki: Privilege EscalationCVE-2026-75891 · affects up to 6.2.5 · reported by WordfenceHigh 8.8
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to overwrite an administrator's password and gain administrative access.
Oct 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Insecure Direct Object ReferenceCVE-2026-107762 · affects up to 6.3.2 · reported by WordfenceHigh 7.5
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: PHP Object InjectionCVE-2026-104734 · affects up to 6.3.2 · reported by WordfenceHigh 7.2
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-14572 · affects up to 6.2.0 · reported by WordfenceMedium 6.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Arbitrary shortcode executionCVE-2026-102291 · affects up to 6.3.1 · reported by WordfenceMedium 5.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection — an ordinary team or member-directory page — the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026Kirki: Does not validate the host of a URL it is given before fetching itCVE-2026-84224 · fixed in 6.3.2 · reported by WPScanMedium 4.1
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
Oct 9, 2026Kirki: Does not prevent shortcodes held in comments from being executedCVE-2026-84220 · fixed in 6.3.2 · reported by WPScanMedium 4.8
The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.
Oct 7, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-102173 · affects up to 6.3.1 · reported by WordfenceHigh 7.2
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2026Kirki: Improper Validation of Specified Quantity in InputCVE-2026-103065 · affects up to 6.3.1 · reported by PatchstackHigh 8.2
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
Sep 24, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Blind Server-Side Request ForgeryCVE-2026-18335 · affects up to 6.2.0 · reported by WordfenceMedium 5.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Sep 20, 2026Kirki: Does not sanitize uploaded SVG files while making them uploadable site-wideCVE-2026-84223 · fixed in 6.3.1 · reported by WPScanMedium 6.8
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
Sep 11, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-17037 · affects up to 6.2.0 · reported by WordfenceHigh 7.2
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Sep 9, 2026Kirki: Does not check whether the requester is allowed to read a post before rendering and returning its page contentCVE-2026-84222 · fixed in 6.3.0 · reported by WPScanMedium 5.3
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.
Sep 6, 2026Kirki: Does not hold back every spelling of the HTML entities it decodesCVE-2026-84219 · fixed in 6.3.0 · reported by WPScanHigh 7.5
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.
Sep 5, 2026Kirki: Does not check that a user is allowed to act on a collaboration comment before changing its stateCVE-2026-84225 · fixed in 6.3.0 · reported by WPScanLow 2.2
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cannot themselves open.
Sep 5, 2026Kirki: Does not escape a user-supplied identifier before using it in a SQL queryCVE-2026-84221 · fixed in 6.3.0 · reported by WPScanMedium 6.8
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials.
Aug 26, 2026Kirki: Does not perform a capability check on some endpoints of one of its public AJAX actionsCVE-2026-77754 · fixed in 6.0.14 · reported by WPScanMedium 5.3
The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
Aug 20, 2026Kirki: Does not properly validate the files contained in archives uploaded by users with the Editor roleCVE-2026-74992 · fixed in 6.2.3 · reported by WPScanMedium 6.8
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.CVE-2026-66629 · affects up to 6.2.3 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.
Aug 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Authorization bypassCVE-2026-18347 · affects up to 6.1.1 · reported by WordfenceMedium 4.3
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Directory TraversalCVE-2026-17604 · affects up to 6.1.1 · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2026Kirki: Does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode executionCVE-2026-16747 · fixed in 6.2.1 · reported by WPScanMedium 6.5
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
Aug 11, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-16974 · affects up to 6.2.0 · reported by WordfenceMedium 6.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Aug 1, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Path Traversal (Zip Slip)CVE-2026-15601 · affects up to 6.0.13 · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026Kirki: Does not properly sanitise and escape a value taken from the request before using it in a SQL statementCVE-2026-12721 · fixed in 6.0.13 · reported by WPScanHigh 8.6
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Jul 31, 2026Kirki: Does not restrictCVE-2026-12720 · fixed in 6.0.13 · reported by WPScanHigh 7.5
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.
Jul 27, 2026Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.CVE-2026-65436 · affects up to 6.0.13 · reported by PatchstackMedium 6.8
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.
Jul 24, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Insecure Direct Object ReferenceCVE-2026-13464 · affects up to 6.0.14 · reported by WordfenceMedium 5.3
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 20, 2026Kirki: Does not validate a user-supplied URL before requesting it server-sideCVE-2026-13147 · fixed in 6.0.12 · reported by WPScanCritical 9.1
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Jul 20, 2026Kirki: Does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sendsCVE-2026-12724 · fixed in 6.0.12 · reported by WPScanMedium 4.3
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
Jul 20, 2026Kirki: Does not perform any authorisation check on one of its REST routesCVE-2026-12723 · fixed in 6.0.12 · reported by WPScanMedium 5.3
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
Jul 17, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Directory TraversalCVE-2026-15457 · affects up to 6.0.13 · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026Kirki: Missing AuthorizationCVE-2026-57727 · affects up to 6.2.0 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0.
Jul 13, 2026Kirki: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57726 · affects up to 6.0.12 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.
Jul 13, 2026Kirki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57725 · affects up to 6.0.11 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.
Jul 13, 2026Kirki: Deserialization of Untrusted DataCVE-2026-57724 · affects up to 6.0.12 · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
Jul 2, 2026Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.CVE-2026-57680 · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.
Jul 2, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Authorization bypassCVE-2026-12472 · affects up to 6.0.11 · reported by WordfenceMedium 5.3
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Sensitive Information ExposureCVE-2026-12122 · affects up to 6.0.11 · reported by WordfenceMedium 5.3
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.CVE-2026-57627 · reported by PatchstackMedium 4.9
Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.
Jun 2, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Privilege escalationCVE-2026-8206 · reported by WordfenceCritical 9.8
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Authorization bypassCVE-2026-8096 · affects up to 6.0.6 · reported by WordfenceMedium 6.5
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Arbitrary file deletionCVE-2026-8073 · affects up to 6.0.6 · reported by WordfenceHigh 7.5
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.