WordPress plugin
Kirki – Freeform Page Builder, Website Builder & Customizer security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 45 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High14
- Medium26
- Low2
All Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities
- High8.8Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
≤6.2.5Update to 6.3.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
≤6.3.2Update to 6.4.0
- High7.2Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
≤6.3.2Update to 6.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Metadata
≤6.3.1Update to 6.3.2
- Critical9.8Unauthenticated Remote Code Execution
≤6.3.1Update to 6.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
≤6.2.0Update to 6.2.1
- High7.26.2.5 - Unauthenticated Stored Cross-Site Scripting
6.2.1 – 6.2.5Update to 6.3.0
- Critical9.8Unauthenticated Remote Code Execution
<6.2.1Update to 6.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.2.4Update to 6.2.5
- High8.1Unauthenticated PHP Object Injection
<6.0.13Update to 6.0.13
- High7.5Unauthenticated SQL Injection
≤6.0.12Update to 6.0.13
- High8.1Unauthenticated PHP Object Injection
≤6.0.12Update to 6.0.13
- High7.5Unauthenticated SQL Injection
≤6.0.12Update to 6.0.13
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.11Update to 6.0.12
- High7.2Unauthenticated Server-Side Request Forgery
≤6.0.11Update to 6.0.12
- Critical9.86.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
6.0.0 – 6.0.6Update to 6.0.7
- High7.5Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
≤6.0.6Update to 6.0.7
Kirki – Freeform Page Builder, Website Builder & Customizer: common questions
Does Kirki – Freeform Page Builder, Website Builder & Customizer have known vulnerabilities?
Yes. VulnCrest Radar lists 45 known vulnerabilities in Kirki – Freeform Page Builder, Website Builder & Customizer: 3 critical, 14 high, 26 medium, 2 low. None are known to affect version null.
How do I check which version of Kirki – Freeform Page Builder, Website Builder & Customizer I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Kirki – Freeform Page Builder, Website Builder & Customizer vulnerability?
CVE-2026-112348, published Oct 30, 2026: Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated reCAPTCHA Validation Bypass. Severity: Medium (CVSS 5.3).
Is any Kirki – Freeform Page Builder, Website Builder & Customizer vulnerability listed in CISA KEV?
No. None of the known Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities is currently listed in the CISA KEV catalog.