Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities
7 known vulnerabilities in Kirki – Freeform Page Builder, Website Builder & Customizer from Themeum. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Kirki – Freeform Page Builder, Website Builder…: Deserialization of Untrusted Data
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due
- 7.5 High severity
Kirki – Freeform Page Builder, Website Builder…: Authorization Bypass Through User-Controlled Key
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. T
- 7.2 High severity
Kirki – Freeform Page Builder, Website Builder…: Deserialization of Untrusted Data
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers,
- 7.2 High severity
Kirki – Freeform Page Builder, Website Builder…: Improper Neutralization of Input During Web Page Generation
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements
- 7.2 High severity
Kirki – Freeform Page Builder, Website Builder…: Improper Neutralization of Input During Web Page Generation
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping
- 9.8 Critical severity
Kirki – Freeform Page Builder, Website Builder…: Improper Privilege Management
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is us
- 7.5 High severity
Kirki – Freeform Page Builder, Website Builder…: Relative Path Traversal
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and includi