Skip to contentThemeum Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX EndpointCVE-2026-758918.8 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' ParameterCVE-2026-1077627.5 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportCVE-2026-1047347.2 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text ContentCVE-2026-145726.4 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'CVE-2026-1022915.4 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration MetadataCVE-2026-1021737.2 High
- themeum kirki – freeform page builder, website builder & customizerKirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' ParameterCVE-2026-183355.4 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' ParameterCVE-2026-170377.2 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' ParameterCVE-2026-183474.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' ParameterCVE-2026-176044.9 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta ShortcodeCVE-2026-169746.4 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)CVE-2026-156014.9 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' ParameterCVE-2026-134645.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' ParameterCVE-2026-154574.9 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' ParametersCVE-2026-124725.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX ActionCVE-2026-121225.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'CVE-2026-8206Public exploit9.8 Critical
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIPCVE-2026-80737.5 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' ActionCVE-2026-80966.5 Medium