Advisories · Technology
themeum Kirki – Freeform Page Builder, Website Builder & Customizer.
Every CVE that names themeum Kirki – Freeform Page Builder, Website Builder & Customizer among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Insecure deserialization
- CVSS 7.2 High
Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Insecure deserialization
- CVSS 7.5 High
Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Broken access control
- CVSS 6.4 Medium
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Other injection
- CVSS 7.2 High
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Broken access control
- CVSS 4.9 Medium
Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Path traversal
- CVSS 6.4 Medium
Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Path traversal
- CVSS 5.3 Medium
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Broken access control
- CVSS 4.9 Medium
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Path traversal
- CVSS 5.3 Medium
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Broken access control
- CVSS 5.3 Medium
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Privilege escalation
- CVSS 7.5 High
Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Path traversal
- CVSS 6.5 Medium
Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Broken access control