Kirki – Freeform Page Builder, Website Builder & Customizer — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in Kirki – Freeform Page Builder, Website Builder & Customizer, with AI-generated Chinese analysis, references, and POCs.

Vendor: themeum

CVE ID	Title	CVSS	Severity	Published
CVE-2026-18335	Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter CWE-918	5.4	Medium	2026-09-24
CVE-2026-17037	Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter CWE-79	7.2	High	2026-09-11
CVE-2026-18347	Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter CWE-862	4.3	Medium	2026-08-16
CVE-2026-17604	Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter CWE-22	4.9	Medium	2026-08-16
CVE-2026-16974	Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode CWE-79	6.4	Medium	2026-08-11
CVE-2026-15601	Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) CWE-22	4.9	Medium	2026-08-01
CVE-2026-13464	Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CWE-639	5.3	Medium	2026-07-24
CVE-2026-15457	Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter CWE-22	4.9	Medium	2026-07-17
CVE-2026-12472	Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters CWE-862	5.3	Medium	2026-07-02
CVE-2026-12122	Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action CWE-862	5.3	Medium	2026-07-02
CVE-2026-8206	Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' CWE-269	9.8	Critical	2026-06-02
CVE-2026-8073	Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP CWE-23	7.5	High	2026-05-19
CVE-2026-8096	Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action CWE-862	6.5	Medium	2026-05-19

All 13 known CVE vulnerabilities affecting Kirki – Freeform Page Builder, Website Builder & Customizer with full Chinese analysis, references, and POCs where available.