The Kirki – Freeform Page Builder plugin for WordPress is affected in all releases up to 6.2.0 by a stored cross‑site scripting flaw. The vulnerability arises from insufficient input sanitization and output escaping of page builder text content, allowing an authenticated user with the kirki_content_access capability to embed arbitrary JavaScript. When a page containing the injected content is viewed, the script runs in the victim’s browser, giving the attacker the ability to steal cookies, deface content, or launch further attacks against users.

The issue impacts the Themeum Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress. All versions 6.2.0 and earlier are affected; the latest version 6.2.1 includes the fix.

The CVSS score of 6.4 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly known exploitation. Attackers must first obtain authenticated access with the kirki_content_access capability, typically granted by a site administrator, and then use the page builder interface to insert malicious code. Once injected, the payload executes for every user who views the affected page, presenting a moderate risk of widespread client‑side compromise.