WordPress plugin
Kirki – Freeform Page Builder, Website Builder & Customizer security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 45 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High14
- Medium26
- Low2
All Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities
- Medium5.3Unauthenticated reCAPTCHA Validation Bypass
≤6.2.4Update to 6.2.5
- Low2.7Missing Authorization
≤6.4.0Update to 6.4.1
- Low3.5Authenticated (Subscriber+) Arbitrary Page Content Injection
≤6.4.0Update to 6.4.1
- High8.8Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
≤6.2.5Update to 6.3.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
≤6.3.2Update to 6.4.0
- High7.2Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
≤6.3.2Update to 6.4.0
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
≤6.2.0Update to 6.2.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
≤6.3.1Update to 6.3.2
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
≤6.3.1Update to 6.3.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤6.3.1Update to 6.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Metadata
≤6.3.1Update to 6.3.2
- Critical9.8Unauthenticated Remote Code Execution
≤6.3.1Update to 6.3.2
- Medium5.4Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
≤6.2.0Update to 6.2.1
- Medium6.46.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.0.0 – 6.3.0Update to 6.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
≤6.2.0Update to 6.2.1
- Medium5.36.2.5 - Unauthenticated Information Exposure
6.2.1 – 6.2.5Update to 6.3.0
- High7.26.2.5 - Unauthenticated Stored Cross-Site Scripting
6.2.1 – 6.2.5Update to 6.3.0
- Medium4.36.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
6.0.0 – 6.2.5Update to 6.3.0
- Medium4.96.2.5 - Authenticated (Editor+) SQL Injection
6.0.0 – 6.2.5Update to 6.3.0
- Medium5.3Missing Authorization
<6.0.14Update to 6.0.14
- Critical9.8Unauthenticated Remote Code Execution
<6.2.1Update to 6.2.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
<6.2.3Update to 6.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.2.4Update to 6.2.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
≤6.1.1Update to 6.2.0
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
≤6.1.1Update to 6.2.0
- Medium6.4Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
≤6.2.0Update to 6.2.1
- High8.1Unauthenticated PHP Object Injection
<6.0.13Update to 6.0.13
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
≤6.0.13Update to 6.1.0
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
≤6.0.14Update to 6.1.0
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
≤6.0.13Update to 6.0.14
- High7.5Unauthenticated SQL Injection
≤6.0.12Update to 6.0.13
- High8.1Unauthenticated PHP Object Injection
≤6.0.12Update to 6.0.13
- Medium5.3Missing Authorization
≤6.2.0Update to 6.2.1
- High7.5Unauthenticated SQL Injection
≤6.0.12Update to 6.0.13
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.11Update to 6.0.12
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
≤6.0.11Update to 6.0.12
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
≤6.0.11Update to 6.0.12
- Medium5.3Unauthenticated Insecure Direct Object Reference
≤6.0.11Update to 6.0.12
- High7.2Unauthenticated Server-Side Request Forgery
≤6.0.11Update to 6.0.12
- Medium5.3Unauthenticated HTML Injection
≤6.0.11Update to 6.0.12
- Medium5.3Missing Authorization
≤6.0.11Update to 6.0.12
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
≤6.0.11Update to 6.0.12
- Critical9.86.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
6.0.0 – 6.0.6Update to 6.0.7
- High7.5Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
≤6.0.6Update to 6.0.7
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
≤6.0.6Update to 6.0.7
Kirki – Freeform Page Builder, Website Builder & Customizer: common questions
Does Kirki – Freeform Page Builder, Website Builder & Customizer have known vulnerabilities?
Yes. VulnCrest Radar lists 45 known vulnerabilities in Kirki – Freeform Page Builder, Website Builder & Customizer: 3 critical, 14 high, 26 medium, 2 low. None are known to affect version null.
How do I check which version of Kirki – Freeform Page Builder, Website Builder & Customizer I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Kirki – Freeform Page Builder, Website Builder & Customizer vulnerability?
CVE-2026-112348, published Oct 30, 2026: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated reCAPTCHA Validation Bypass. Severity: Medium (CVSS 5.3).
Is any Kirki – Freeform Page Builder, Website Builder & Customizer vulnerability listed in CISA KEV?
No. None of the known Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities is currently listed in the CISA KEV catalog.