Extension WordPress
Vulnérabilités Kirki – Freeform Page Builder, Website Builder & Customizer
Cette page rassemble les failles publiées pour Kirki – Freeform Page Builder, Website Builder & Customizer, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Kirki – Freeform Page Builder, Website Builder & Customizer
11 fiches
Kirki <= 6.0.13 – Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with…
*-6.0.13
6.0.14
16/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.13 – Missing Authorization
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.13. This makes it possible…
*-6.0.13
Non indiqué
06/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 – Unauthenticated SQL Injection
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient…
*-6.0.12
6.0.13
06/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 – Unauthenticated Stored Cross-Site Scripting
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.0.11 due to insufficient input sanitization and output escaping. This makes it possible…
*-6.0.11
6.0.12
06/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 – Unauthenticated PHP Object Injection
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.0.12 via deserialization of untrusted input. This makes it possible for unauthenticated attackers…
*-6.0.12
6.0.13
06/07/2026
Kirki <= 6.0.11 – Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to…
*-6.0.11
6.0.12
01/07/2026
Kirki <= 6.0.11 – Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user…
*-6.0.11
6.0.12
01/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 – Authenticated (Subscriber+) Server-Side Request Forgery
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and…
*-6.0.11
6.0.12
26/06/2026
Kirki 6.0.0 – 6.0.6 – Unauthenticated Privilege Escalation via 'handle_forgot_password'
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address…
6.0.0-6.0.6
6.0.7
01/06/2026
Kirki <= 6.0.6 – Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to,…
*-6.0.6
6.0.7
19/05/2026
Kirki <= 6.0.6 – Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user…
*-6.0.6
6.0.7
19/05/2026
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.