WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Kirki – Freeform Page Builder, Website Builder & Customizer

Freeform page builder & website builder for WordPress. Infinite canvas for complex, interactive websites. Built-in forms, animations & Customizer.

26Reported vulnerabilities
9.8Highest CVSS score
6.2.3Latest version
500,000+Active installs

What to do now

Update Kirki – Freeform Page Builder, Website Builder & Customizer to 6.0.14 or later. 25 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2026-8206 Critical 9.8 1.3% 6.0.0 to 6.0.6 (inclusive) 6.0.7 June 2, 2026
CVE-2026-57724 High 8.1 0.6% 6.0.12 and earlier 6.0.13 July 6, 2026
CVE-2026-12720 High 8.1 0.4% Before 6.0.13 6.0.13 August 4, 2026
CVE-2026-8073 High 7.5 0.6% 0 to 6.0.6 (inclusive) 6.0.7 May 19, 2026
CVE-2026-12721 High 7.5 0.3% 6.0.12 and earlier 6.0.13 July 14, 2026
CVE-2026-57726 High 7.5 0.4% 6.0.12 and earlier 6.0.13 July 6, 2026
CVE-2026-13147 High 7.2 0.9% 6.0.11 and earlier 6.0.12 June 29, 2026
CVE-2026-57725 High 7.2 0.3% 6.0.11 and earlier 6.0.12 July 6, 2026
CVE-2026-66629 High 7.2 0.2% 6.2.4 and earlier — August 18, 2026
CVE-2026-16747 Medium 6.5 0.2% 0 up to (but not including) 6.2.1 6.2.1 August 12, 2026
CVE-2026-8096 Medium 6.5 0.4% 0 to 6.0.6 (inclusive) 6.0.7 May 19, 2026
CVE-2026-16974 Medium 6.4 0.2% 6.2.0 and earlier 6.2.1 August 10, 2026
CVE-2026-57627 Medium 6.4 0.2% 6.0.11 and earlier 6.0.12 June 26, 2026
CVE-2026-12472 Medium 5.3 0.6% 0 to 6.0.11 (inclusive) 6.0.12 July 2, 2026
CVE-2026-77754 Medium 5.3 0.3% Before 6.0.14 6.0.14 August 26, 2026
CVE-2026-13464 Medium 5.3 0.3% 0 to 6.0.14 (inclusive) 6.1.0 July 24, 2026
CVE-2026-15457 Medium 4.9 1.1% 0 to 6.0.13 (inclusive) 6.0.14 July 17, 2026
CVE-2026-57727 Medium 5.3 0.4% 6.2.0 and earlier 6.2.1 July 6, 2026
CVE-2026-12122 Medium 5.3 0.5% 0 to 6.0.11 (inclusive) 6.0.12 July 2, 2026
CVE-2026-57680 Medium 5.3 0.3% 6.0.11 and earlier 6.0.12 June 30, 2026
CVE-2026-12723 Medium 5.3 0.3% 6.0.11 and earlier 6.0.12 June 29, 2026
CVE-2026-12724 Medium 5.3 0.1% 6.0.11 and earlier 6.0.12 June 29, 2026
CVE-2026-17604 Medium 4.9 0.8% 0 to 6.1.1 (inclusive) 6.2.0 August 16, 2026
CVE-2026-15601 Medium 4.9 0.7% 0 to 6.0.13 (inclusive) 6.1.0 August 1, 2026
CVE-2026-74992 Medium 4.4 0.3% Before 6.2.3 6.2.3 August 21, 2026
CVE-2026-18347 Medium 4.3 0.3% 0 to 6.1.1 (inclusive) 6.2.0 August 16, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.