CVE · High
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-66629 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] <= 6.2.4 (unfixed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 6.2.4 | 6.2.4 | 2026-08-18 | — |
An unauthenticated attacker can inject malicious JavaScript code into a vulnerable Kirki plugin, potentially allowing them to steal user data, hijack user sessions, or execute arbitrary code on the affected system. This vulnerability is present in versions of Kirki prior to 6.2.4.
Based on public CVE data (MITRE/NVD).
No signup, no credit card — enter your URL and get a security report in seconds.