WP Security CheckVulnerability data as of October 22, 2026

Known vulnerabilities in Kirki – Freeform Page Builder, Website Builder & Customizer

Freeform page builder & website builder for WordPress. Infinite canvas for complex, interactive websites. Built-in forms, animations & Customizer.

41Reported vulnerabilities
9.8Highest CVSS score
6.2.3Latest version
500,000+Active installs

What to do now

Update Kirki – Freeform Page Builder, Website Builder & Customizer to 6.4.0 or later. 41 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2026-8206 Critical 9.8 0.8% 6.0.0 to 6.0.6 (inclusive) 6.0.7 June 2, 2026
CVE-2026-103065 Critical 9.8 0.2% 6.3.1 and earlier 6.3.2 October 1, 2026
CVE-2026-12720 High 8.1 0.5% Before 6.0.13 6.0.13 August 4, 2026
CVE-2026-57724 High 8.1 0.6% 6.0.12 and earlier 6.0.13 July 6, 2026
CVE-2026-13147 High 7.2 1.5% 6.0.11 and earlier 6.0.12 June 29, 2026
CVE-2026-8073 High 7.5 0.5% 0 to 6.0.6 (inclusive) 6.0.7 May 19, 2026
CVE-2026-107762 High 7.5 0.4% 0 to 6.3.2 (inclusive) 6.4.0 October 17, 2026
CVE-2026-12721 High 7.5 0.4% 6.0.12 and earlier 6.0.13 July 14, 2026
CVE-2026-57726 High 7.5 0.4% 6.0.12 and earlier 6.0.13 July 6, 2026
CVE-2026-104734 High 7.2 0.5% 0 to 6.3.2 (inclusive) 6.4.0 October 17, 2026
CVE-2026-102173 High 7.2 0.4% 0 to 6.3.1 (inclusive) 6.3.2 October 7, 2026
CVE-2026-84219 High 7.2 0.4% 6.2.1 to 6.2.5 (inclusive) 6.3.0 September 8, 2026
CVE-2026-66629 High 7.2 0.3% 6.2.4 and earlier 6.2.5 August 18, 2026
CVE-2026-57725 High 7.2 0.3% 6.0.11 and earlier 6.0.12 July 6, 2026
CVE-2026-17037 High 7.2 0.2% 6.2.0 and earlier 6.2.1 September 10, 2026
CVE-2026-84223 Medium 6.4 0.4% 6.0.0 to 6.3.0 (inclusive) 6.3.1 September 18, 2026
CVE-2026-16747 Medium 6.5 0.4% 0 up to (but not including) 6.2.1 6.2.1 August 12, 2026
CVE-2026-16974 Medium 6.4 0.3% 6.2.0 and earlier 6.2.1 August 10, 2026
CVE-2026-8096 Medium 6.5 0.5% 0 to 6.0.6 (inclusive) 6.0.7 May 19, 2026
CVE-2026-14572 Medium 6.4 0.2% 0 to 6.2.0 (inclusive) 6.2.1 October 15, 2026
CVE-2026-57627 Medium 6.4 0.2% 6.0.11 and earlier 6.0.12 June 26, 2026
CVE-2026-102291 Medium 5.4 0.3% 0 to 6.3.1 (inclusive) 6.3.2 October 10, 2026
CVE-2026-18335 Medium 5.4 0.3% 6.2.0 and earlier 6.2.1 September 23, 2026
CVE-2026-12472 Medium 5.3 0.6% 0 to 6.0.11 (inclusive) 6.0.12 July 2, 2026
CVE-2026-84222 Medium 5.3 0.3% 6.2.1 to 6.2.5 (inclusive) 6.3.0 September 9, 2026
CVE-2026-77754 Medium 5.3 0.3% Before 6.0.14 6.0.14 August 26, 2026
CVE-2026-17604 Medium 4.9 1.2% 0 to 6.1.1 (inclusive) 6.2.0 August 16, 2026
CVE-2026-15601 Medium 4.9 1.1% 0 to 6.0.13 (inclusive) 6.1.0 August 1, 2026
CVE-2026-13464 Medium 5.3 0.5% 0 to 6.0.14 (inclusive) 6.1.0 July 24, 2026
CVE-2026-15457 Medium 4.9 1.1% 0 to 6.0.13 (inclusive) 6.0.14 July 17, 2026
CVE-2026-57727 Medium 5.3 0.4% 6.2.0 and earlier 6.2.1 July 6, 2026
CVE-2026-12122 Medium 5.3 0.5% 0 to 6.0.11 (inclusive) 6.0.12 July 2, 2026
CVE-2026-57680 Medium 5.3 0.3% 6.0.11 and earlier 6.0.12 June 30, 2026
CVE-2026-12723 Medium 5.3 0.3% 6.0.11 and earlier 6.0.12 June 29, 2026
CVE-2026-12724 Medium 5.3 0.1% 6.0.11 and earlier 6.0.12 June 29, 2026
CVE-2026-84221 Medium 4.9 0.4% 6.0.0 to 6.2.5 (inclusive) 6.3.0 September 5, 2026
CVE-2026-84220 Medium 4.8 0.1% 0 up to (but not including) 6.3.2 6.3.2 October 9, 2026
CVE-2026-74992 Medium 4.4 0.4% Before 6.2.3 6.2.3 August 21, 2026
CVE-2026-18347 Medium 4.3 0.5% 0 to 6.1.1 (inclusive) 6.2.0 August 16, 2026
CVE-2026-84225 Medium 4.3 0.2% 6.0.0 to 6.2.5 (inclusive) 6.3.0 September 5, 2026
CVE-2026-84224 Medium 4.1 0.2% 0 up to (but not including) 6.3.2 6.3.2 October 9, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.