kirki_freeform_page_builder_website_builder_customizer vulnerabilities
CVEs whose affected-version data names the kirki_freeform_page_builder_website_builder_customizer package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-18335Medium· 5.4The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible fo…
▾ Sunlitthemeum · Kirki – Freeform Page Builder, Website Builder & CustomizerEPSS 0.26%via NVD
CVE-2026-17037High· 7.2Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitizat…
▾ Twilightthemeum · Kirki – Freeform Page Builder, Website Builder & CustomizerEPSS 0.19%via CVEORG