Vulnerabilities / Kirki – Freeform Page Builder, Website Builder & Customizer
Kirki – Freeform Page Builder, Website Builder & Customizer vulnerabilities
Advisories WPSec published for Kirki – Freeform Page Builder, Website Builder & Customizer. Other sources may list more. Its attack surface: Kirki – Freeform Page Builder, Website Builder & Customizer on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-14 | WPSEC-2026-0899 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Authenticated (Editor+) PHP Object Injection via Template Import | Medium 6.6 | 6.4.0 |
| 2026-10-14 | WPSEC-2026-0898 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.2 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via Collection Rendering 'context' Parameter | Medium 5.3 | 6.4.0 |
License: CC BY 4.0