PLUGIN SECURITY
Is Kirki safe?
Freeform page builder & website builder for WordPress. Infinite canvas for complex, interactive websites. Built-in forms, animations & Customizer.
What this plugin does
- Slug:
kirki - Author: Themeum
- 500000+ active installs
- 90/100 rating (81 reviews on wordpress.org)
- 15351991 all-time downloads
- On WordPress.org since 2014-05-27
drag-and-dropform builderfreeform canvaspage builderwebsite builder
Maintenance status
- Latest known version: 6.2.1
- Last updated: 2026-08-25 3:48pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
26 known CVEs on file for Kirki.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-77754 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.14 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 6.0.14 | 6.0.14 | 2026-08-26 | ✓ fixed in latest |
| CVE-2026-74992 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 6.2.3 | 6.2.3 | 2026-08-20 | ⚠ update needed |
| CVE-2026-66629 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] <= 6.2.4 (unfixed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 6.2.4 | 6.2.4 | 2026-08-18 | ⚠ update needed |
| CVE-2026-17604 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.0 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.9 | < 6.2.0 | 6.2.0 | 2026-08-15 | ✓ fixed in latest |
| CVE-2026-18347 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.0 | Missing Authorization | Medium 4.3 | < 6.2.0 | 6.2.0 | 2026-08-15 | ✓ fixed in latest |
| CVE-2026-16747 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 6.5 | < 6.2.1 | 6.2.1 | 2026-08-12 | ✓ fixed in latest |
| CVE-2026-12720 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | Deserialization of Untrusted Data | Unknown | < 6.0.13 | 6.0.13 | 2026-07-31 | ✓ fixed in latest |
| CVE-2026-16974 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 6.2.1 | 6.2.1 | 2026-07-31 | ✓ fixed in latest |
+ 19 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-15601 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.1.0 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.9 | < 6.1.0 | 6.1.0 | 2026-07-23 | ✓ fixed in latest |
| CVE-2026-15457 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.9 | < 6.0.14 | 6.0.14 | 2026-07-16 | ✓ fixed in latest |
| CVE-2026-12721 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 6.0.13 | 6.0.13 | 2026-07-14 | ✓ fixed in latest |
| CVE-2026-57727 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] <= 6.1.1 (unfixed) | — | High 7.5 | < 6.1.1 | 6.1.1 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57726 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | — | Critical 9.3 | < 6.0.13 | 6.0.13 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57725 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | — | High 7.1 | < 6.0.12 | 6.0.12 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57724 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.13 | — | Critical 9.8 | < 6.0.13 | 6.0.13 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-57680 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Authorization Bypass Through User-Controlled Key | Medium 6.5 | < 6.0.12 | 6.0.12 | 2026-07-02 | ✓ fixed in latest |
| CVE-2026-12122 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Missing Authorization | Medium 5.3 | < 6.0.12 | 6.0.12 | 2026-07-01 | ✓ fixed in latest |
| CVE-2026-12472 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Missing Authorization | Medium 5.3 | < 6.0.12 | 6.0.12 | 2026-07-01 | ✓ fixed in latest |
| CVE-2026-12724 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Insufficient Verification of Data Authenticity | Unknown | < 6.0.12 | 6.0.12 | 2026-06-29 | ✓ fixed in latest |
| CVE-2026-12723 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Missing Authorization | Unknown | < 6.0.12 | 6.0.12 | 2026-06-29 | ✓ fixed in latest |
| CVE-2026-13147 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Server-Side Request Forgery (SSRF) | Unknown | < 6.0.12 | 6.0.12 | 2026-06-29 | ✓ fixed in latest |
| CVE-2026-57627 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.12 | Server-Side Request Forgery (SSRF) | Medium 4.9 | < 6.0.12 | 6.0.12 | 2026-06-26 | ✓ fixed in latest |
| CVE-2026-8206 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 | Improper Privilege Management | Critical 9.8 | < 6.0.7 | 6.0.7 | 2026-06-01 | ✓ fixed in latest |
| CVE-2026-8096 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 | Missing Authorization | Medium 6.5 | < 6.0.7 | 6.0.7 | 2026-05-19 | ✓ fixed in latest |
| CVE-2026-8073 | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.0.7 | Relative Path Traversal | High 7.5 | < 6.0.7 | 6.0.7 | 2026-05-19 | ✓ fixed in latest |
| — | Kirki – Freeform Page Builder, Website Builder & Customizer [kirki] < 6.1.0 | — | Unknown | < 6.1.0 | 6.1.0 | 0000-00-00 | ✓ fixed in latest |
| CVE-2026-13464 | Kirki < 6.1.0 - Unauthenticated Sensitive Data Disclosure via context Parameter | — | Unknown | < 6.1.0 | 6.1.0 | — | ✓ fixed in latest |
How to fix it
Keep Kirki updated — 6.2.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7297)
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14369)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ active installs — 96/100 (791)
- MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor — 600000+ active installs — 94/100 (504) — max PHP 8.4
- Ninja Forms – The Contact Form Builder That Grows With You — 600000+ active installs — 88/100 (1395) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.