Themeum Kirki – Freeform Page Builder, Website Builder & Customizer

• CVE-2026-75891 High 8.8 Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint 0.3%
• CVE-2026-104734 High 7.2 Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import 0.5%
• CVE-2026-107762 High 7.5 Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter 0.4%
• CVE-2026-14572 Medium 6.4 Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content 0.2%
• CVE-2026-102291 Medium 5.4 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' 0.3%
• CVE-2026-102173 High 7.2 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata 0.4%
• CVE-2026-18335 Medium 5.4 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter 0.2%
• CVE-2026-17037 High 7.2 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter 0.3%
• CVE-2026-18347 Medium 4.3 Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter 0.5%
• CVE-2026-17604 Medium 4.9 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter 1.2%
• CVE-2026-16974 Medium 6.4 Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode 0.3%
• CVE-2026-15601 Medium 4.9 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) 1.1%
• CVE-2026-13464 Medium 5.3 Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter 0.5%
• CVE-2026-15457 Medium 4.9 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter 1.1%
• CVE-2026-12472 Medium 5.3 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters 0.6%
• CVE-2026-12122 Medium 5.3 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action 0.5%
• CVE-2026-8206 Critical 9.8 Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' 1.3%
• CVE-2026-8073 High 7.5 Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP 0.6%
• CVE-2026-8096 Medium 6.5 Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action 0.4%