Vulnerabilities and security researches forghostkit ghostkit

Jul 20, 2025

CVE, Research URL: CVE-2025-53567
Home page URL: Security reports for Ghost Kit – Page Builder Blocks & Extensions
Application: Ghost Kit – Page Builder Blocks & Extensions
Date: Aug 20, 2025
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit ghostkit allows PHP Local File Inclusion.This issue affects Ghost Kit: from n/a through <= 3.4.1.
Affected versions: max 3.4.2.
Status: vulnerable

Apr 23, 2026

CVE, Research URL: CVE-2025-9992
Home page URL: Security reports for Ghost Kit – Page Builder Blocks & Extensions
Application: Ghost Kit – Page Builder Blocks & Extensions
Date: Sep 18, 2025
Research Description: The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.4.4.
Status: vulnerable