Extension WordPress
Vulnérabilités Kirki – Freeform Page Builder, Website Builder & Customizer
Cette page rassemble les failles publiées pour Kirki – Freeform Page Builder, Website Builder & Customizer, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Kirki – Freeform Page Builder, Website Builder & Customizer
25 fiches
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.1 – Unauthenticated Remote Code Execution
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 6.2.1. This is due to insufficient validation of user supplied input before it is…
[*, 6.2.1)
6.2.1
24/08/2026
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 – Authenticated (Editor+) Stored Cross-Site Scripting
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 6.2.3. This is due to insufficient input sanitization and output escaping. This makes it…
[*, 6.2.3)
6.2.3
21/08/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 – Unauthenticated Stored Cross-Site Scripting
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.2.4. This is due to insufficient input sanitization and output escaping. This…
*-6.2.4
Non indiqué
18/08/2026
Kirki <= 6.1.1 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user…
*-6.1.1
6.2.0
15/08/2026
Kirki <= 6.1.1 – Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers,…
*-6.1.1
6.2.0
15/08/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output…
*-6.2.0
6.2.1
10/08/2026
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 – Unauthenticated PHP Object Injection
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to 6.0.13 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject…
[*, 6.0.13)
6.0.13
04/08/2026
Kirki <= 6.0.13 – Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated…
*-6.0.13
6.1.0
31/07/2026
Kirki <= 6.0.14 – Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a…
*-6.0.14
6.1.0
23/07/2026
Kirki <= 6.0.13 – Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with…
*-6.0.13
6.0.14
16/07/2026
Kirki <= 6.0.12 – Unauthenticated SQL Injection
The Kirki plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
*-6.0.12
6.0.13
14/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 – Missing Authorization
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.2.0. This makes it possible…
*-6.2.0
6.2.1
06/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 – Unauthenticated SQL Injection
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient…
*-6.0.12
6.0.13
06/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 – Unauthenticated Stored Cross-Site Scripting
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.0.11 due to insufficient input sanitization and output escaping. This makes it possible…
*-6.0.11
6.0.12
06/07/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 – Unauthenticated PHP Object Injection
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.0.12 via deserialization of untrusted input. This makes it possible for unauthenticated attackers…
*-6.0.12
6.0.13
06/07/2026
Kirki <= 6.0.11 – Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to…
*-6.0.11
6.0.12
01/07/2026
Kirki <= 6.0.11 – Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user…
*-6.0.11
6.0.12
01/07/2026
Kirki <= 6.0.11 – Unauthenticated Insecure Direct Object Reference
The Kirki plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.0.11. This is due to missing authentication and ownership verification when processing a user-supplied comment_id in the comment edit path…
*-6.0.11
6.0.12
30/06/2026
Kirki <= 6.0.11 – Unauthenticated HTML Injection
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to inject HTML in password…
*-6.0.11
6.0.12
29/06/2026
Kirki <= 6.0.11 – Unauthenticated Server-Side Request Forgery
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to make web requests…
*-6.0.11
6.0.12
29/06/2026
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.