Vulnerabilities and security researches forkirki kirki

Direction: descending

Aug 28, 2026

Kirki Customizer Framework # CVE-2026-77754

CVE, Research URL: CVE-2026-77754
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Aug 26, 2026
Research Description: The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated users to retrieve the email addresses of registered users and comment authors, as well as non-public page content and settings.
Affected versions: max 6.0.14.
Status: vulnerable

Aug 20, 2026

Kirki Customizer Framework # CVE-2026-66629

CVE, Research URL: CVE-2026-66629
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Aug 18, 2026
Research Description: Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.
Affected versions: max 6.2.3.
Status: vulnerable

Aug 17, 2026

Kirki Customizer Framework # CVE-2026-17604

CVE, Research URL: CVE-2026-17604
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Aug 16, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
Affected versions: max 6.2.0.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-18347

CVE, Research URL: CVE-2026-18347
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Aug 16, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.
Affected versions: max 6.2.0.
Status: vulnerable

Aug 13, 2026

Kirki Customizer Framework # CVE-2026-16747

CVE, Research URL: CVE-2026-16747
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Aug 12, 2026
Research Description: The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
Affected versions: max 6.2.1.
Status: vulnerable

Aug 11, 2026

Kirki Customizer Framework # CVE-2026-16974

CVE, Research URL: CVE-2026-16974
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Aug 11, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 6.2.1.
Status: vulnerable

Aug 01, 2026

Kirki Customizer Framework # CVE-2026-12721

CVE, Research URL: CVE-2026-12721
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 31, 2026
Research Description: The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Affected versions: max 6.0.13.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-15601

CVE, Research URL: CVE-2026-15601
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Aug 01, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
Affected versions: max 6.1.0.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-12720

CVE, Research URL: CVE-2026-12720
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 31, 2026
Research Description: The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.
Affected versions: max 6.0.13.
Status: vulnerable

Jul 29, 2026

Kirki Customizer Framework # CVE-2026-13464

CVE, Research URL: CVE-2026-13464
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 24, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.
Affected versions: max 6.1.0.
Status: vulnerable

Jul 21, 2026

Kirki Customizer Framework # CVE-2026-13147

CVE, Research URL: CVE-2026-13147
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 20, 2026
Research Description: The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Affected versions: max 6.0.12.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-12724

CVE, Research URL: CVE-2026-12724
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 20, 2026
Research Description: The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
Affected versions: max 6.0.12.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-12723

CVE, Research URL: CVE-2026-12723
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 20, 2026
Research Description: The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
Affected versions: max 6.0.12.
Status: vulnerable

Jul 17, 2026

Kirki Customizer Framework # CVE-2026-15457

CVE, Research URL: CVE-2026-15457
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 17, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
Affected versions: max 6.0.14.
Status: vulnerable

Jul 15, 2026

Kirki Customizer Framework # CVE-2026-57724

CVE, Research URL: CVE-2026-57724
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 13, 2026
Research Description: Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
Affected versions: max 6.0.13.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-57727

CVE, Research URL: CVE-2026-57727
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 13, 2026
Research Description: Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through <= 6.0.13.
Affected versions: max 6.0.13.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-57725

CVE, Research URL: CVE-2026-57725
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 13, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.
Affected versions: max 6.0.12.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-57726

CVE, Research URL: CVE-2026-57726
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 13, 2026
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.
Affected versions: max 6.0.13.
Status: vulnerable

Jul 03, 2026

Kirki Customizer Framework # CVE-2026-12472

CVE, Research URL: CVE-2026-12472
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 02, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
Affected versions: max 6.0.12.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-12122

CVE, Research URL: CVE-2026-12122
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jul 02, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
Affected versions: max 6.0.12.
Status: vulnerable

Jun 29, 2026

Kirki Customizer Framework # CVE-2026-57627

CVE, Research URL: CVE-2026-57627
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jun 26, 2026
Research Description: Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.
Affected versions: max 6.0.12.
Status: vulnerable

Jun 03, 2026

Kirki Customizer Framework # CVE-2026-8206

CVE, Research URL: CVE-2026-8206
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: Jun 02, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
Affected versions: Min 6.0.0, max 6.0.6.
Status: vulnerable

May 22, 2026

Kirki Customizer Framework # CVE-2026-8073

CVE, Research URL: CVE-2026-8073
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: May 20, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.
Affected versions: max 6.0.7.
Status: vulnerable

Kirki Customizer Framework # CVE-2026-8096

CVE, Research URL: CVE-2026-8096
Home page URL: Security reports for Kirki Customizer Framework
Application: Kirki Customizer Framework
Date: May 20, 2026
Research Description: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.
Affected versions: max 6.0.7.
Status: vulnerable