Kirki – Freeform Page Builder, Website Builder & Customizer

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The vector marks UI:N, but the narrative’s victim viewing or interaction requirement still applies. The structured affected range is <= 6.4.0.

Kirki 6.2.5 and earlier deserializes untrusted input in the get-single-symbol branch of the kirki_post_apis() AJAX dispatcher without the required capability check. A Subscriber or higher-privilege user can inject a PHP object. Overwriting an administrator’s password and gaining administrator access additionally requires a usable POP chain; object injection alone does not establish that result on every installation. The serialized-input parameter and the required POP-chain classes are not disclosed.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone. The export initially names Administrator access but explicitly identifies Editor access under the default FULL_ACCESS configuration. Do not assume this is restricted to administrators; a suitable object chain in another installed component is still required for the stated downstream impacts. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

A Subscriber can put shortcode text in their own display_name through the core profile interface. If a published Kirki element uses the dynamic display_name value, TheFrontend::replace_content inserts it into the page and then runs do_shortcode across the result. This can execute registered shortcodes in the viewing user’s context, including anonymous visitors. Effects depend on available shortcodes and configuration; arbitrary PHP execution is not established. Affected versions: <= 6.3.1.

An Editor or higher-privileged user can supply a URL whose host is not validated before a server-side fetch. The site can consequently request internal services inaccessible to the caller, and response differences reveal which services are live. The export does not name the endpoint, URL parameter or fetch function, and does not establish full response-body disclosure. No victim interaction is required by the vector. The vector reports limited confidentiality impact, no integrity impact, no availability impact. Affected versions: < 6.3.2. The authoritative export identifies 6.3.2 as fixed for this CVE.

An unauthenticated visitor can put registered shortcodes into a comment. Kirki renders comments regardless of moderation status and executes their shortcodes, allowing the visitor to invoke site-registered shortcode behavior and read private custom fields of the displayed page. The export does not name the rendering function or specific shortcodes, and does not establish arbitrary PHP execution. No victim interaction is required by the vector. The vector reports limited confidentiality impact, limited integrity impact, no availability impact. The vector also reports high attack complexity; the export establishes only the preconditions described here. Affected versions: < 6.3.2. The authoritative export identifies 6.3.2 as fixed for this CVE.

With public user registration enabled and a published page containing a kirki-register element, an unauthenticated attacker can obtain the element nonce from public markup and submit malicious registration metadata. ExceptionalElements::image_element() places a user-meta value directly into an img src attribute without sufficient escaping. A page rendering a Kirki users collection whose image is bound to one of nine registration meta fields can then execute the stored script when viewed. The nine field names are not enumerated. Viewing the affected output is necessary despite UI:N in the vector. Affected versions: <= 6.3.1.

Kirki through 6.3.1 has an input-quantity validation failure that permits access to functionality not properly constrained by access controls. The authoritative CVSS vector requires neither an attacker account nor victim interaction and reports high confidentiality and low integrity impact. The export does not identify the operation, endpoint, parameter, invalid quantity or exposed data; a specific exploitation path is not disclosed. The authoritative export identifies the fixed release as 6.3.2.

An unauthenticated attacker can supply kirki_data that causes the application to make requests to arbitrary destinations, including internal services. This is blind SSRF: the export does not establish direct access to response bodies. The endpoint, request-building function and exact request constraints are unspecified; effects on an internal service depend on what it accepts. Affected versions: <= 6.2.0. Confirmed fixed release: 6.2.1.

Kirki enables SVG uploads site-wide without sanitizing the files. An Author or higher role can upload an SVG containing script that executes in the site's origin when a visitor, including an administrator, opens it. File viewing is required; the export does not disclose the upload handler or a separate account-takeover sequence. Authoritative affected range: 6.0.0 to < 6.3.1. Confirmed remediation: 6.3.1.

Kirki versions 6.2.1 to before 6.3.0 return rendered page content without checking whether the requester may read the post. Unauthenticated users can retrieve private, draft, pending, and trashed page content.

Kirki 6.2.1 through 6.2.x does not block every spelling of the HTML entities it decodes during rendering. An unauthenticated commenter can store JavaScript that executes for anyone viewing an affected page, including an Administrator; when comments are incorporated into a Kirki-built header or footer, the payload can execute site-wide.

Kirki is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is 6.0.0 to < 6.3.0.

Kirki is affected by a security weakness. Exploitation requires an authenticated editor account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is 6.0.0 to < 6.3.0.

Kirki before 6.0.14 omits capability checks from endpoints exposed through a public AJAX action. An unauthenticated attacker can retrieve registered-user and comment-author email addresses together with non-public page content and settings.

Kirki before 6.2.3 does not adequately validate files inside archives uploaded by an Editor and does not remove every unwanted file after extraction. An Editor can therefore place an arbitrary file in a web-accessible directory. A malicious browser-rendered file can produce stored cross-site scripting, while executable PHP can lead to remote code execution on server configurations that execute PHP from the destination directory.

Kirki is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 6.2.3.

Kirki through 6.1.1 lets an authenticated user with the affected custom-level access supply any WordPress user ID and a user-type context to its frontend collection endpoint. Missing object authorization returns the target's email, roles, registration date, and arbitrary user_meta values, including administrator records. The public.

Kirki through 6.1.1 uses a substring-based uploads-directory check on the data parameter. An Editor can supply a URL that contains the uploads base path but also includes traversal segments such as /wp-content/uploads/../../wp-config.php, bypassing the guard and reading arbitrary files accessible to PHP. The public.

Kirki before 6.2.1 exposes POST /wp-json/kirki/v1/frontend/form to unauthenticated visitors. A request can supply unsigned _kirki_form metadata and form fields; the submission service loads the selected form configuration and EmailActionHandler::send_single_email_action() passes configured recipient, Reply-To, name and subject fields through do_shortcode() before wp_mail(). This allows any shortcode registered on the site to run. On a default installation, the CNA says this can disclose the administrator email address and relay mail to an attacker-chosen recipient. Version 6.2.1 signs the metadata and restricts shortcode replacement to approved placeholders. The exact reporter payload is not disclosed.

Kirki through 6.2.0 does not adequately sanitize input or escape output used by its post_meta shortcode. A Contributor or higher role can store a crafted shortcode in a page, and the injected script executes whenever a user views that page. Version 6.2.1 addresses the XSS among its security fixes.

Kirki through 6.0.13 accepts a user-supplied app src in install_app, update_app and get_kirki_template_from_zip, downloads that archive and passes it to extract_zip_file() without blocking traversing entry names. A user with the plugin's custom-level access can write files outside the intended directory and potentially place executable PHP for server-side code execution.

Kirki before 6.0.13 places an unauthenticated request value into a SQL statement without sufficient sanitization or escaping. An attacker can alter the generated database query and use the SQL-injection primitive to infer or read data available to the WordPress database account. The published.

Kirki before 6.0.13 lets an unauthenticated visitor store serialized data and later deserializes that data without restricting which PHP classes may be instantiated when an administrator reviews the stored record. This creates a PHP object-injection primitive. If another installed plugin, theme or outdated WordPress component supplies a suitable gadget chain, the attacker can use object side effects for impacts such as file deletion, file read or remote code execution; without such a gadget chain, those impacts are not established. The published.

Kirki through 6.0.13 lets an Editor supply a file target to an undisclosed deletion operation without adequate path confinement. The operation can delete a server file writable by PHP, causing data loss or site failure.

An unauthenticated POST to /wp-json/kirki/v1/frontend/collection can select context type post and an arbitrary numeric post ID, then use attacker-controlled kirki_data blocks to render the target's title, content and excerpt. Vulnerable releases expose drafts, pending, private, password-protected and trashed posts because the route does not enforce read_post permission for nonpublic targets.

Kirki is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests. The published affected range is < 6.0.12.

Kirki is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 6.0.12.

Kirki is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 6.0.12.

Kirki 6.0.13 and earlier trusts a caller-controlled family value while handling font data. An authenticated editor can supply a traversal or absolute path and cause directories outside the intended font location to be deleted, creating a direct availability and data-loss risk.

Kirki is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 6.0.13.

Kirki is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 6.0.12.

Kirki is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 6.0.11.

Kirki is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 6.0.12.

Kirki is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 6.0.11.

Kirki – Freeform Page Builder, Website Builder & Customizer is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 6.0.11.

Kirki – Freeform Page Builder, Website Builder & Customizer is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 6.0.11.

Kirki is affected by server-side request forgery. Exploitation requires an authenticated subscriber account. The vulnerable server can be induced to make attacker-selected network requests. The published affected range is n/a through 6.0.11.

Kirki – Freeform Page Builder, Website Builder & Customizer is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is 6.0.0 through 6.0.6.

Kirki – Freeform Page Builder, Website Builder & Customizer is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 6.0.6.

Kirki – Freeform Page Builder, Website Builder & Customizer is affected by arbitrary file deletion. The vulnerable path is reachable without authentication. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is <= 6.0.6.