Vulnerabilities and security researches forkirki kirki
Direction: ascendingMay 22, 2026
Kirki Customizer Framework # CVE-2026-8073
- CVE, Research URL
- Home page URL
- Application
- Date
- May 20, 2026
- Research Description
- The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.
- Affected versions
-
max 6.0.7.
- Status
-
vulnerable
Kirki Customizer Framework # CVE-2026-8096
- CVE, Research URL
- Home page URL
- Application
- Date
- May 20, 2026
- Research Description
- The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.
- Affected versions
-
max 6.0.7.
- Status
-
vulnerable
Jun 03, 2026
Kirki Customizer Framework # CVE-2026-8206
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 02, 2026
- Research Description
- The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
- Affected versions
-
max 6.0.7.
- Status
-
vulnerable
Jun 29, 2026
Kirki Customizer Framework # CVE-2026-57627
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 26, 2026
- Research Description
- Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.
- Affected versions
-
max 6.0.12.
- Status
-
vulnerable
Jul 03, 2026
Kirki Customizer Framework # CVE-2026-12472
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 02, 2026
- Research Description
- The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
- Affected versions
-
max 6.0.12.
- Status
-
vulnerable
Kirki Customizer Framework # CVE-2026-12122
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 02, 2026
- Research Description
- The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
- Affected versions
-
max 6.0.12.
- Status
-
vulnerable
Jul 15, 2026
Kirki Customizer Framework # CVE-2026-57724
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 13, 2026
- Research Description
- Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
- Affected versions
-
max 6.0.13.
- Status
-
vulnerable
Kirki Customizer Framework # CVE-2026-57727
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 13, 2026
- Research Description
- Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through <= 6.0.13.
- Affected versions
-
max 6.0.13.
- Status
-
vulnerable
Kirki Customizer Framework # CVE-2026-57725
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 13, 2026
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.
- Affected versions
-
max 6.0.12.
- Status
-
vulnerable
Kirki Customizer Framework # CVE-2026-57726
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 13, 2026
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.
- Affected versions
-
max 6.0.13.
- Status
-
vulnerable
Jul 17, 2026
Kirki Customizer Framework # CVE-2026-15457
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 17, 2026
- Research Description
- The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
- Affected versions
-
max 6.0.14.
- Status
-
vulnerable
Jul 21, 2026
Kirki Customizer Framework # CVE-2026-13147
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 20, 2026
- Research Description
- The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
- Affected versions
-
max 6.0.12.
- Status
-
vulnerable
Kirki Customizer Framework # CVE-2026-12724
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 20, 2026
- Research Description
- The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
- Affected versions
-
max 6.0.12.
- Status
-
vulnerable
Kirki Customizer Framework # CVE-2026-12723
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 20, 2026
- Research Description
- The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
- Affected versions
-
max 6.0.12.
- Status
-
vulnerable