Read the docs
TI-2026-70228 Aliases CVE-2026-102291GHSA-v9xh-p885-r83g

Arbitrary shortcode execution in Kirki Freeform Page Builder plugin

Priority LOW 24CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Kirki (Freeform Page Builder, Website Builder & Customizer) plugin for WordPress from 0 through 6.3.1 is affected. It substitutes a user's display_name into page markup without filtering and then runs the result through do_shortcode(), an improper neutralization flaw (CWE-74). An authenticated attacker with Subscriber access or higher can set their own display_name to execute arbitrary shortcodes, and on pages that list users, such as team or member directories, the shortcode runs for every visitor, including unauthenticated ones. Exploitation requires a published page with a Kirki element bound to the display_name user field.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's `display_name` into the composed page markup unfiltered and then running the whole result through `do_shortcode()` in `TheFrontend::replace_content()`. Because `display_name` is writable by any user on their own account through the core profile form, this makes it possible for authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. Where the page is a users collection — an ordinary team or member-directory page — the shortcode runs in the request of every visitor, including unauthenticated ones. Requires a published page with a Kirki element whose dynamic content is bound to the `display_name` user field.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
themeumKirki – Freeform Page Builder, Website Builder & Customizerup to 6.3.1—No fix listedCNA
  • Kirki – Freeform Page Builder, Website Builder & Customizer Vendorthemeum Affected up to 6.3.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Kirki (Freeform Page Builder, Website Builder & Customizer).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-102291
  2. 2026-10-10 Alias added: GHSA-v9xh-p885-r83g
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-11 CISA SSVC decision points changed

References

Other 8

  • TI-2024-09629 Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter CVSS 3.1HIGH 7.5
  • TI-2023-02936 Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API CVSS 3.1HIGH 7.5
  • TI-2021-07196 Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending CVSS 3.1HIGH 7.5
  • TI-2023-05666 WP Crowdfunding < 2.1.9 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2023-00225 Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2023-04422 Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
See all 171 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences