Kirki Freeform Page Builder Website Builder Customizer
Monthly
Privilege escalation in the Kirki plugin for WordPress (all versions up to and including 6.2.5) allows authenticated users with only Subscriber-level access to reach a vulnerable deserialization path in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which lacks a capability check, and to inject a PHP object. Because a POP chain is present in the running code, a successful injection can overwrite an administrator's password and hand the attacker full administrative control of the site. The CVSS vector confirms network reachability, low privileges (PR:L), and no user interaction (UI:N) for a high-integrity, high-availability impact; EPSS is low at 0.30% (23rd percentile) and there is no KEV listing, so there is no public exploit identified at time of analysis, though the practical exposure is governed by whether a site permits open user registration.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Account takeover in the Kirki Freeform Page Builder WordPress plugin (versions 6.0.0 through 6.0.6) allows unauthenticated remote attackers to hijack any registered account, including administrators, by redirecting password reset links to attacker-controlled email addresses. The flaw stems from the plugin honoring an arbitrary email value supplied alongside a valid username in password reset requests, breaking the trust binding between account and recovery destination. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's published advisory make weaponization straightforward.
Arbitrary file read and deletion in the Kirki - Freeform Page Builder plugin for WordPress (versions through 6.0.6) allows unauthenticated remote attackers to read and delete files within the WordPress uploads base directory by abusing the 'downloadZIP' function. The flaw stems from insufficient path validation and a missing capability check, and was reported by Wordfence; no public exploit identified at time of analysis.
Stored cross-site scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.2.0) lets an authenticated user who has been granted the administrator-controlled kirki_content_access capability save arbitrary JavaScript through the Page Builder Text Content field, which then executes in the browser of any user who later views the injected page. Exploitation requires that capability grant, which is a non-default, elevated content permission rather than a standard subscriber or author role, and the stored payload only fires on a subsequent victim page view; upgrading to 6.2.1 removes the flaw. No public exploit code, proof-of-concept, or CISA KEV entry has been identified at the time of analysis, and this rates as a moderate, not high-urgency, issue.
Arbitrary shortcode execution in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.3.1) lets any authenticated user with Subscriber-level access or above inject shortcodes by writing them into their own `display_name` profile field, which the plugin splices unfiltered into composed page markup and then passes through `do_shortcode()`. The flaw is exploitable as a remote, network-reachable issue requiring only a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4), rated moderate by the independent assessment; the key precondition is that a published page must exist containing a Kirki element whose dynamic content is explicitly bound to the `display_name` user field - typically a team or member-directory / users-collection page - and on sites without such a page the vulnerable code path is never reached. Where that binding does exist, the injected shortcode executes in the request of every visitor, including unauthenticated ones, so per-victim interaction is not required; no public exploit code or confirmed active exploitation was identified at time of analysis.
Blind server-side request forgery in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0, allows unauthenticated remote attackers to make the WordPress server issue HTTP requests to arbitrary locations by supplying an attacker-controlled URL in the 'kirki_data' parameter. Because the SSRF is blind (no response body is returned to the attacker), exploitation is assessed as high-complexity: the attacker must already know or correctly guess reachable internal hosts or services, so the practical impact is limited to internal service enumeration, state-changing requests against unauthenticated internal endpoints, and access to cloud instance-metadata addresses that the host can reach. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), making this a moderate-risk, not top-priority, issue for most deployments - though it becomes materially more serious on hosts with broad outbound network reachability or attached cloud IAM roles.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated `context` parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.
Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.11) enables unauthenticated remote attackers to trigger arbitrary HTML-injected emails to any registered user via the site's own mail infrastructure. Because the email is dispatched through the site's authenticated SMTP path, it inherits the domain's SPF and DKIM reputation, substantially increasing phishing credibility. Critically, attackers can embed a genuine, site-generated WordPress password-reset URL for the target account inside an attacker-controlled HTML body, creating a highly convincing credential-harvesting lure. No public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated sensitive information exposure in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions through 6.0.11) permits any remote attacker to retrieve the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by issuing a crafted AJAX request with a sequential WordPress post ID. The root cause is a missing authorization check (CWE-862) in the get_single_symbol AJAX handler registered in includes/Ajax.php, confirmed by Wordfence. No active exploitation is confirmed in CISA KEV, and no EPSS data was provided, but the trivially automatable nature of post ID enumeration against an unauthenticated network endpoint elevates practical risk above the raw CVSS 5.3 score suggests.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.6) allows authenticated attackers with subscriber-level privileges to enumerate and read all frontend form structures and stored visitor submission data, including contact details and messages submitted through any site form powered by the plugin. The flaw originates in missing authorization checks on an AJAX handler (Ajax.php, line 675), meaning any logged-in user - including the lowest-privilege role WordPress assigns - can exfiltrate sensitive visitor-submitted information without any administrative context. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege barrier and network-accessible attack vector make this a realistic data exposure risk for any multi-user or public-registration WordPress site running the affected plugin.
Privilege escalation in the Kirki plugin for WordPress (all versions up to and including 6.2.5) allows authenticated users with only Subscriber-level access to reach a vulnerable deserialization path in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which lacks a capability check, and to inject a PHP object. Because a POP chain is present in the running code, a successful injection can overwrite an administrator's password and hand the attacker full administrative control of the site. The CVSS vector confirms network reachability, low privileges (PR:L), and no user interaction (UI:N) for a high-integrity, high-availability impact; EPSS is low at 0.30% (23rd percentile) and there is no KEV listing, so there is no public exploit identified at time of analysis, though the practical exposure is governed by whether a site permits open user registration.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Account takeover in the Kirki Freeform Page Builder WordPress plugin (versions 6.0.0 through 6.0.6) allows unauthenticated remote attackers to hijack any registered account, including administrators, by redirecting password reset links to attacker-controlled email addresses. The flaw stems from the plugin honoring an arbitrary email value supplied alongside a valid username in password reset requests, breaking the trust binding between account and recovery destination. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's published advisory make weaponization straightforward.
Arbitrary file read and deletion in the Kirki - Freeform Page Builder plugin for WordPress (versions through 6.0.6) allows unauthenticated remote attackers to read and delete files within the WordPress uploads base directory by abusing the 'downloadZIP' function. The flaw stems from insufficient path validation and a missing capability check, and was reported by Wordfence; no public exploit identified at time of analysis.
Stored cross-site scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.2.0) lets an authenticated user who has been granted the administrator-controlled kirki_content_access capability save arbitrary JavaScript through the Page Builder Text Content field, which then executes in the browser of any user who later views the injected page. Exploitation requires that capability grant, which is a non-default, elevated content permission rather than a standard subscriber or author role, and the stored payload only fires on a subsequent victim page view; upgrading to 6.2.1 removes the flaw. No public exploit code, proof-of-concept, or CISA KEV entry has been identified at the time of analysis, and this rates as a moderate, not high-urgency, issue.
Arbitrary shortcode execution in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.3.1) lets any authenticated user with Subscriber-level access or above inject shortcodes by writing them into their own `display_name` profile field, which the plugin splices unfiltered into composed page markup and then passes through `do_shortcode()`. The flaw is exploitable as a remote, network-reachable issue requiring only a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4), rated moderate by the independent assessment; the key precondition is that a published page must exist containing a Kirki element whose dynamic content is explicitly bound to the `display_name` user field - typically a team or member-directory / users-collection page - and on sites without such a page the vulnerable code path is never reached. Where that binding does exist, the injected shortcode executes in the request of every visitor, including unauthenticated ones, so per-victim interaction is not required; no public exploit code or confirmed active exploitation was identified at time of analysis.
Blind server-side request forgery in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0, allows unauthenticated remote attackers to make the WordPress server issue HTTP requests to arbitrary locations by supplying an attacker-controlled URL in the 'kirki_data' parameter. Because the SSRF is blind (no response body is returned to the attacker), exploitation is assessed as high-complexity: the attacker must already know or correctly guess reachable internal hosts or services, so the practical impact is limited to internal service enumeration, state-changing requests against unauthenticated internal endpoints, and access to cloud instance-metadata addresses that the host can reach. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), making this a moderate-risk, not top-priority, issue for most deployments - though it becomes materially more serious on hosts with broad outbound network reachability or attached cloud IAM roles.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated `context` parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.
Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.11) enables unauthenticated remote attackers to trigger arbitrary HTML-injected emails to any registered user via the site's own mail infrastructure. Because the email is dispatched through the site's authenticated SMTP path, it inherits the domain's SPF and DKIM reputation, substantially increasing phishing credibility. Critically, attackers can embed a genuine, site-generated WordPress password-reset URL for the target account inside an attacker-controlled HTML body, creating a highly convincing credential-harvesting lure. No public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated sensitive information exposure in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions through 6.0.11) permits any remote attacker to retrieve the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by issuing a crafted AJAX request with a sequential WordPress post ID. The root cause is a missing authorization check (CWE-862) in the get_single_symbol AJAX handler registered in includes/Ajax.php, confirmed by Wordfence. No active exploitation is confirmed in CISA KEV, and no EPSS data was provided, but the trivially automatable nature of post ID enumeration against an unauthenticated network endpoint elevates practical risk above the raw CVSS 5.3 score suggests.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.6) allows authenticated attackers with subscriber-level privileges to enumerate and read all frontend form structures and stored visitor submission data, including contact details and messages submitted through any site form powered by the plugin. The flaw originates in missing authorization checks on an AJAX handler (Ajax.php, line 675), meaning any logged-in user - including the lowest-privilege role WordPress assigns - can exfiltrate sensitive visitor-submitted information without any administrative context. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege barrier and network-accessible attack vector make this a realistic data exposure risk for any multi-user or public-registration WordPress site running the affected plugin.