# Kirki – Freeform Page Builder, Website Builder & Customizer

> Freeform page builder & website builder for WordPress. Infinite canvas for complex, interactive websites. Built-in forms, animations & Customizer.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:22 UTC.

## Facts (WordPress.org)

- Slug: `kirki`
- Author: Themeum
- Version: 6.4.1
- Active installs: 400,000+
- Last update: 2026-10-28 (9 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.9, PHP 7.4
- Tags: drag-and-drop, form builder, freeform canvas, page builder, website builder
- Page: https://wordpress.org/plugins/kirki/

## Checks (against WordPress 7.1.4)

- OK: Updated 9 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Locked in ↔ Portable, Paywalled ↔ Generous, Breaking ↔ Smooth.

## Known vulnerabilities

- 2026-10-30 LOW: Missing Authorization (up to 6.4.0). CVE-2026-112347, https://www.wordfence.com/threat-intel/vulnerabilities/id/691e355f-9963-4e94-86f4-b9166262310b?source=api-prod
- 2026-10-30 MEDIUM: Unauthenticated reCAPTCHA Validation Bypass (up to 6.2.4). CVE-2026-112348, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8557731-924d-4b35-97ca-bc8f37067f5d?source=api-prod
- 2026-10-29 LOW: Authenticated (Subscriber+) Arbitrary Page Content Injection (up to 6.4.0). CVE-2026-42694, https://www.wordfence.com/threat-intel/vulnerabilities/id/e080ab50-028d-46c3-a786-ab89b12692b7?source=api-prod
- 2026-10-27 HIGH: Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint (up to 6.2.5). CVE-2026-75891, https://www.wordfence.com/threat-intel/vulnerabilities/id/aecfea73-97fc-48c3-bf1b-5314077739b5?source=api-prod
- 2026-10-17 HIGH: Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import (up to 6.3.2). CVE-2026-104734, https://www.wordfence.com/threat-intel/vulnerabilities/id/3c760235-ee53-4906-9e25-19df85b8f8ff?source=api-prod
- 2026-10-17 HIGH: Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter (up to 6.3.2). CVE-2026-107762, https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2fd69f-d432-4eb2-9d28-cfd7dd100e82?source=api-prod
- 2026-10-15 MEDIUM: Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content (up to 6.2.0). CVE-2026-14572, https://www.wordfence.com/threat-intel/vulnerabilities/id/fba01aca-d59f-49ec-bf12-2ad53d39205f?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' (up to 6.3.1). CVE-2026-102291, https://www.wordfence.com/threat-intel/vulnerabilities/id/bed93040-a843-417e-89b4-5ab3cba788aa?source=api-prod
- 2026-10-09 MEDIUM: Unauthenticated Arbitrary Shortcode Execution (up to 6.3.1). CVE-2026-84220, https://www.wordfence.com/threat-intel/vulnerabilities/id/cc43e33c-f375-4ce1-9c6c-eff8236480dd?source=api-prod
- 2026-10-09 MEDIUM: Authenticated (Editor+) Server-Side Request Forgery (up to 6.3.1). CVE-2026-84224, https://www.wordfence.com/threat-intel/vulnerabilities/id/61ae1dfc-0491-4cf4-b791-2b0cd1426a14?source=api-prod
- 2026-10-07 HIGH: Unauthenticated Stored Cross-Site Scripting via Registration Metadata (up to 6.3.1). CVE-2026-102173, https://www.wordfence.com/threat-intel/vulnerabilities/id/368001e9-3806-41d5-902e-0facf7fb31ff?source=api-prod
- 2026-10-03 CRITICAL: Unauthenticated Remote Code Execution (up to 6.3.1). CVE-2026-103065, https://www.wordfence.com/threat-intel/vulnerabilities/id/e6617c63-7659-4d8c-85de-d24f599375c1?source=api-prod
- 2026-09-24 MEDIUM: Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter (up to 6.2.0). CVE-2026-18335, https://www.wordfence.com/threat-intel/vulnerabilities/id/461be8a5-bf72-4028-88e6-bf6544120ac6?source=api-prod
- 2026-09-20 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (6.0.0 to 6.3.0). CVE-2026-84223, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1954372-ea9b-44c0-b84b-5fa49efc9fb4?source=api-prod
- 2026-09-11 HIGH: Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter (up to 6.2.0). CVE-2026-17037, https://www.wordfence.com/threat-intel/vulnerabilities/id/e578af07-90ec-4bd4-91ec-b793bbccf977?source=api-prod
- 2026-09-09 MEDIUM: Unauthenticated Information Exposure (6.2.1 to 6.2.5). CVE-2026-84222, https://www.wordfence.com/threat-intel/vulnerabilities/id/aad053ac-d01f-4f89-abca-28b9fce4f249?source=api-prod
- 2026-09-06 HIGH: Unauthenticated Stored Cross-Site Scripting (6.2.1 to 6.2.5). CVE-2026-84219, https://www.wordfence.com/threat-intel/vulnerabilities/id/49664262-ad86-426e-8f66-9ada61a25bd7?source=api-prod
- 2026-09-05 MEDIUM: Authenticated (Editor+) SQL Injection (6.0.0 to 6.2.5). CVE-2026-84221, https://www.wordfence.com/threat-intel/vulnerabilities/id/2e79835c-9df6-410a-88f5-1cadfada7419?source=api-prod
- 2026-09-05 MEDIUM: Authenticated (Custom Role+) Insecure Direct Object Reference (6.0.0 to 6.2.5). CVE-2026-84225, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ceae1e5-49d6-4591-b756-594ac8e701ff?source=api-prod
- 2026-08-26 MEDIUM: Missing Authorization (before 6.0.14). CVE-2026-77754, https://www.wordfence.com/threat-intel/vulnerabilities/id/537b44d4-c227-4241-9ffe-b83177b4225b?source=api-prod
- 2026-08-20 MEDIUM: Authenticated (Editor+) Stored Cross-Site Scripting (before 6.2.3). CVE-2026-74992, https://www.wordfence.com/threat-intel/vulnerabilities/id/8243b65b-8340-404d-90cb-5706fb239dc2?source=api-prod
- 2026-08-18 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 6.2.4). CVE-2026-66629, https://www.wordfence.com/threat-intel/vulnerabilities/id/191c7d9e-79a1-400d-8f05-5fab422ae042?source=api-prod
- 2026-08-16 MEDIUM: Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter (up to 6.1.1). CVE-2026-17604, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ecb2c6-c2d0-44b0-b9c2-4fcbc0f97632?source=api-prod
- 2026-08-16 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter (up to 6.1.1). CVE-2026-18347, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1e0bcd-f881-4b01-b802-7cb18a22a07f?source=api-prod
- 2026-08-12 CRITICAL: Unauthenticated Remote Code Execution (before 6.2.1). CVE-2026-16747, https://www.wordfence.com/threat-intel/vulnerabilities/id/ee755e25-5f70-4688-b08d-4a3f127d91d4?source=api-prod
- 2026-08-11 MEDIUM: Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta... (up to 6.2.0). CVE-2026-16974, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9fe6b4-8696-45eb-bdb8-764dea7cce88?source=api-prod
- 2026-08-01 MEDIUM: Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) (up to 6.0.13). CVE-2026-15601, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ccd1314-b9b9-4f63-820c-2817a4932ee8?source=api-prod
- 2026-07-31 HIGH: Unauthenticated PHP Object Injection (before 6.0.13). CVE-2026-12720, https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c51f6b-e3ce-4408-8fcb-a56c3b1eee04?source=api-prod
- 2026-07-31 HIGH: Unauthenticated SQL Injection (up to 6.0.12). CVE-2026-12721, https://www.wordfence.com/threat-intel/vulnerabilities/id/4029d1a9-9640-4676-b38d-9e6af2032660?source=api-prod
- 2026-07-24 MEDIUM: Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter (up to 6.0.14). CVE-2026-13464, https://www.wordfence.com/threat-intel/vulnerabilities/id/84f65255-f710-44f9-9f77-61776a40abae?source=api-prod
- 2026-07-20 MEDIUM: Missing Authorization (up to 6.0.11). CVE-2026-12723, https://www.wordfence.com/threat-intel/vulnerabilities/id/d390186e-b6a3-4c9c-8065-2ac4fff9be37?source=api-prod
- 2026-07-20 MEDIUM: Unauthenticated HTML Injection (up to 6.0.11). CVE-2026-12724, https://www.wordfence.com/threat-intel/vulnerabilities/id/e70ada17-f129-4675-93b4-a41a7ea93833?source=api-prod
- 2026-07-20 HIGH: Unauthenticated Server-Side Request Forgery (up to 6.0.11). CVE-2026-13147, https://www.wordfence.com/threat-intel/vulnerabilities/id/cf346e71-9baa-473b-8a65-1f22dae8118f?source=api-prod
- 2026-07-17 MEDIUM: Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter (up to 6.0.13). CVE-2026-15457, https://www.wordfence.com/threat-intel/vulnerabilities/id/01a52285-2d0c-4b29-8dab-18a3e3640e5c?source=api-prod
- 2026-07-13 HIGH: Unauthenticated PHP Object Injection (up to 6.0.12). CVE-2026-57724, https://www.wordfence.com/threat-intel/vulnerabilities/id/2b8db99d-95ec-41e6-bdb4-9db598ed80e1?source=api-prod
- 2026-07-13 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 6.0.11). CVE-2026-57725, https://www.wordfence.com/threat-intel/vulnerabilities/id/35db7137-aba0-4299-ad8a-c650d6db5199?source=api-prod
- 2026-07-13 HIGH: Unauthenticated SQL Injection (up to 6.0.12). CVE-2026-57726, https://www.wordfence.com/threat-intel/vulnerabilities/id/193bd3b8-1af9-496a-ad77-dd5253612272?source=api-prod
- 2026-07-13 MEDIUM: Missing Authorization (up to 6.2.0). CVE-2026-57727, https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff92bf8-371e-4d47-881c-a0f9eadc5061?source=api-prod
- 2026-07-02 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 6.0.11). CVE-2026-57680, https://www.wordfence.com/threat-intel/vulnerabilities/id/62a831ac-3bec-43b0-915e-b6858757cb1c?source=api-prod
- 2026-07-02 MEDIUM: Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action (up to 6.0.11). CVE-2026-12122, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b5db7fa-2e72-4719-b85e-cc31778c2274?source=api-prod
- 2026-07-02 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject'... (up to 6.0.11). CVE-2026-12472, https://www.wordfence.com/threat-intel/vulnerabilities/id/af01964f-018d-4d19-8627-8889877db105?source=api-prod
- 2026-06-26 MEDIUM: Authenticated (Subscriber+) Server-Side Request Forgery (up to 6.0.11). CVE-2026-57627, https://www.wordfence.com/threat-intel/vulnerabilities/id/6979f943-f348-4750-932f-54f0011cd23c?source=api-prod
- 2026-06-02 CRITICAL: Unauthenticated Privilege Escalation via 'handle_forgot_password' (6.0.0 to 6.0.6). CVE-2026-8206, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5630bd-5bce-4226-959f-5e81ae69b799?source=api-prod
- 2026-05-19 HIGH: Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP (up to 6.0.6). CVE-2026-8073, https://www.wordfence.com/threat-intel/vulnerabilities/id/b073edd0-3f40-423e-976e-996b29caf66e?source=api-prod
- 2026-05-19 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action (up to 6.0.6). CVE-2026-8096, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4414b1-6a49-42f8-9927-93763d1502ce?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=kirki · HTML: https://todaywp.com/plugins/kirki