Kirki – Freeform Page Builder, Website Builder & Customizer
Approved changes feed: RSS · Atom
cpe:2.3:a:themeum:kirki_–_freeform_page_builder,_website_builder_&_customizer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Themeum (12449a9f-b8a3-5f81-9e39-f958a6d45415) |
|---|---|
| Product | Kirki – Freeform Page Builder, Website Builder & Customizer (d24d07e8-217e-5762-ad7d-8d645ed01577) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15601 |
vulnerable | 2026-09-16 04:33:06.869056 |
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
MEDIUM (4.9)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file function. This makes it possible for authenticated attackers, with custom-level access and above, to write arbitrary files on the server, which can allow for remote code execution. The install_app, update_app, and get_kirki_template_from_zip code paths accept a user-supplied app src value to construct the download URL, and no sanitization is applied to prevent a crafted ZIP from being fetched and extracted with path-traversing entry names that escape the intended destination directory.
Published: 2026-08-01T07:49:46.331Z
Updated: 2026-08-03T18:36:23.813Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17037 |
vulnerable | 2026-09-16 04:33:02.848720 |
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
HIGH (7.2)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-09-11T09:27:20.479Z
Updated: 2026-09-11T11:12:01.482Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16974 |
vulnerable | 2026-09-16 04:32:56.843896 |
Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
MEDIUM (6.4)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-08-11T04:25:50.325Z
Updated: 2026-08-11T17:07:21.766Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15457 |
vulnerable | 2026-07-29 00:26:18.119083 |
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
MEDIUM (4.9)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
Published: 2026-07-17T03:43:40.514Z
Updated: 2026-07-21T01:27:08.585Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13464 |
vulnerable | 2026-07-29 00:23:33.066457 |
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
MEDIUM (5.3)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full title, content, and excerpt of any WordPress post — including drafts, pending, privately published, password-protected, and trashed posts — regardless of author, by supplying an arbitrary post ID via the context parameter alongside an attacker-controlled block template.
Published: 2026-07-24T02:31:59.162Z
Updated: 2026-07-24T14:40:01.097Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12472 |
vulnerable | 2026-07-29 00:23:32.351683 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12122 |
vulnerable | 2026-07-29 00:23:32.057891 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8206 |
vulnerable | 2026-06-08 08:08:58.197722 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8096 |
vulnerable | 2026-06-08 08:08:58.078540 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8073 |
vulnerable | 2026-06-08 08:08:58.058237 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.