PLUGIN SECURITY
Is Kirki safe?
Freeform page builder & website builder for WordPress. Infinite canvas for complex, interactive websites. Built-in forms, animations & Customizer.
What this plugin does
- Slug:
kirki - Author: Themeum
- 400000+ active installs
- 90/100 rating (81 reviews on wordpress.org)
- 16187046 all-time downloads
- On WordPress.org since 2014-05-27
drag-and-dropform builderfreeform canvaspage builderwebsite builder
Maintenance status
- Latest known version: 6.2.1
- Last updated: 2026-10-28 8:36am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
45 known CVEs on file for Kirki.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-112348 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.5 | — | Medium 6.5 | < 6.2.5 | 6.2.5 | 2026-10-30 | ⚠ update needed |
| CVE-2026-112347 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.4.1 | — | High 7.6 | < 6.4.1 | 6.4.1 | 2026-10-30 | ⚠ update needed |
| CVE-2026-42694 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.4.1 | — | Medium 4.3 | < 6.4.1 | 6.4.1 | 2026-10-29 | ⚠ update needed |
| CVE-2026-104734 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.4.0 | Deserialization of Untrusted Data | High 7.2 | < 6.4.0 | 6.4.0 | 2026-10-16 | ⚠ update needed |
| CVE-2026-107762 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.4.0 | Authorization Bypass Through User-Controlled Key | High 7.5 | < 6.4.0 | 6.4.0 | 2026-10-16 | ⚠ update needed |
| CVE-2026-75891 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.0 | Deserialization of Untrusted Data | High 8.8 | < 6.3.0 | 6.3.0 | 2026-10-16 | ⚠ update needed |
| CVE-2026-84224 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.2 | Server-Side Request Forgery (SSRF) | Medium 4.1 | < 6.3.2 | 6.3.2 | 2026-10-09 | ⚠ update needed |
| CVE-2026-84220 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.2 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 4.8 | < 6.3.2 | 6.3.2 | 2026-10-09 | ⚠ update needed |
+ 41 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-14572 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 6.2.1 | 6.2.1 | 2026-10-09 | ✓ fixed in latest |
| CVE-2026-102291 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.2 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 5.4 | < 6.3.2 | 6.3.2 | 2026-10-06 | ⚠ update needed |
| CVE-2026-103065 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.2 | — | High 8.2 | < 6.3.2 | 6.3.2 | 2026-10-03 | ⚠ update needed |
| CVE-2026-102173 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 6.3.2 | 6.3.2 | 2026-09-23 | ⚠ update needed |
| CVE-2026-18335 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | Server-Side Request Forgery (SSRF) | Medium 5.4 | < 6.2.1 | 6.2.1 | 2026-09-18 | ✓ fixed in latest |
| — | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 6.2.1 | 6.2.1 | 2026-09-11 | ✓ fixed in latest |
| CVE-2026-84223 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] >= 6.0.0 - < 6.3.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.8 | 6.0.0–6.3.1 | 6.3.1 | 2026-09-10 | ⚠ update needed |
| CVE-2026-84222 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] >= 6.2.1 - < 6.3.0 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | 6.2.1–6.3.0 | 6.3.0 | 2026-09-09 | ⚠ update needed |
| CVE-2026-84219 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.5 | < 6.3.0 | 6.3.0 | 2026-09-05 | ⚠ update needed |
| CVE-2026-84225 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.0 | Authorization Bypass Through User-Controlled Key | Unknown | < 6.3.0 | 6.3.0 | 2026-09-05 | ⚠ update needed |
| CVE-2026-84221 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.3.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 6.3.0 | 6.3.0 | 2026-09-05 | ⚠ update needed |
| CVE-2026-77754 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.14 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 6.0.14 | 6.0.14 | 2026-08-24 | ✓ fixed in latest |
| CVE-2026-74992 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 6.2.3 | 6.2.3 | 2026-08-20 | ⚠ update needed |
| — | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 6.2.5 | 6.2.5 | 2026-08-18 | ⚠ update needed |
| CVE-2026-17604 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.0 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.9 | < 6.2.0 | 6.2.0 | 2026-08-15 | ✓ fixed in latest |
| CVE-2026-18347 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.0 | Missing Authorization | Medium 4.3 | < 6.2.0 | 6.2.0 | 2026-08-15 | ✓ fixed in latest |
| CVE-2026-16747 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 6.5 | < 6.2.1 | 6.2.1 | 2026-08-12 | ✓ fixed in latest |
| CVE-2026-12720 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | Deserialization of Untrusted Data | Unknown | < 6.0.13 | 6.0.13 | 2026-07-31 | ✓ fixed in latest |
| CVE-2026-16974 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 6.2.1 | 6.2.1 | 2026-07-31 | ✓ fixed in latest |
| CVE-2026-15601 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.1.0 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.9 | < 6.1.0 | 6.1.0 | 2026-07-23 | ✓ fixed in latest |
| CVE-2026-15457 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.9 | < 6.0.14 | 6.0.14 | 2026-07-16 | ✓ fixed in latest |
| CVE-2026-12721 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 6.0.13 | 6.0.13 | 2026-07-14 | ✓ fixed in latest |
| — | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | — | High 7.5 | < 6.2.1 | 6.2.1 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57726 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | — | Critical 9.3 | < 6.0.13 | 6.0.13 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57725 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | — | High 7.1 | < 6.0.12 | 6.0.12 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57724 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | — | Critical 9.8 | < 6.0.13 | 6.0.13 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57680 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Authorization Bypass Through User-Controlled Key | Medium 6.5 | < 6.0.12 | 6.0.12 | 2026-07-02 | ✓ fixed in latest |
| CVE-2026-12122 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Missing Authorization | Medium 5.3 | < 6.0.12 | 6.0.12 | 2026-07-01 | ✓ fixed in latest |
| CVE-2026-12472 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Missing Authorization | Medium 5.3 | < 6.0.12 | 6.0.12 | 2026-07-01 | ✓ fixed in latest |
| CVE-2026-12724 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Insufficient Verification of Data Authenticity | Unknown | < 6.0.12 | 6.0.12 | 2026-06-29 | ✓ fixed in latest |
| CVE-2026-12723 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Missing Authorization | Unknown | < 6.0.12 | 6.0.12 | 2026-06-29 | ✓ fixed in latest |
| CVE-2026-13147 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Server-Side Request Forgery (SSRF) | Unknown | < 6.0.12 | 6.0.12 | 2026-06-29 | ✓ fixed in latest |
| CVE-2026-57627 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Server-Side Request Forgery (SSRF) | Medium 4.9 | < 6.0.12 | 6.0.12 | 2026-06-26 | ✓ fixed in latest |
| CVE-2026-8206 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 | Improper Privilege Management | Critical 9.8 | < 6.0.7 | 6.0.7 | 2026-06-01 | ✓ fixed in latest |
| CVE-2026-8096 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 | Missing Authorization | Medium 6.5 | < 6.0.7 | 6.0.7 | 2026-05-19 | ✓ fixed in latest |
| CVE-2026-8073 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 | Relative Path Traversal | High 7.5 | < 6.0.7 | 6.0.7 | 2026-05-19 | ✓ fixed in latest |
| — | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.1.0 | — | Unknown | < 6.1.0 | 6.1.0 | 0000-00-00 | ✓ fixed in latest |
| CVE-2026-57727 | Kirki < 6.2.1 - Unauthenticated Missing Authorization | — | Unknown | < 6.2.1 | 6.2.1 | — | ✓ fixed in latest |
| CVE-2026-13464 | Kirki < 6.1.0 - Unauthenticated Sensitive Data Disclosure via context Parameter | — | Unknown | < 6.1.0 | 6.1.0 | — | ✓ fixed in latest |
| CVE-2026-66629 | Kirki < 6.2.5 - Unauthenticated Stored XSS | — | Unknown | < 6.2.5 | 6.2.5 | — | ⚠ update needed |
| CVE-2026-17037 | Kirki < 6.2.1 - Unauthenticated Stored XSS via 'comment' Parameter | — | Unknown | < 6.2.1 | 6.2.1 | — | ✓ fixed in latest |
How to fix it
Keep Kirki updated — 6.2.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7323)
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14390)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 800000+ active installs — 96/100 (808) — max PHP <8.0
- MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor — 500000+ active installs — 94/100 (509) — max PHP 8.4
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder — 500000+ active installs — 88/100 (1398) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.