5.4
Moyenne
CVE-2026-18335 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind…
Description
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kirki – Freeform Page Builder, Website Builder & Customizer 6.2 | premières → 6.2.0 | Pas de correctif indiqué |
Autres CVE de Kirki – Freeform Page Builder, Website Builder & Customizer
Les 19 CVE de Kirki – Freeform Page Builder, Website Builder & Customizer →
CVE-2026-75891
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and…
8.8
Élevée
CVE-2026-107762
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct…
7.5
Élevée
CVE-2026-104734
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object…
7.2
Élevée
CVE-2026-14572
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored…
6.4
Moyenne