Extension WordPress
Vulnérabilités Kirki – Freeform Page Builder, Website Builder & Customizer, page 2
Cette page rassemble les failles publiées pour Kirki – Freeform Page Builder, Website Builder & Customizer, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Kirki – Freeform Page Builder, Website Builder & Customizer
26 fiches
Kirki <= 6.0.11 – Unauthenticated Server-Side Request Forgery
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to make web requests…
*-6.0.11
6.0.12
29/06/2026
Kirki <= 6.0.11 – Missing Authorization
The Kirki plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.11. This makes it possible for unauthenticated attackers to perform an unauthorized action.
*-6.0.11
6.0.12
29/06/2026
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 – Authenticated (Subscriber+) Server-Side Request Forgery
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and…
*-6.0.11
6.0.12
26/06/2026
Kirki 6.0.0 – 6.0.6 – Unauthenticated Privilege Escalation via 'handle_forgot_password'
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address…
6.0.0-6.0.6
6.0.7
01/06/2026
Kirki <= 6.0.6 – Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to,…
*-6.0.6
6.0.7
19/05/2026
Kirki <= 6.0.6 – Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user…
*-6.0.6
6.0.7
19/05/2026
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.