CVE-2026-102291

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.3.2

Description Authenticated attackers with Subscriber-level access and above can execute arbitrary shortcodes. This occurs because the plugin substitutes a user's display name into the page markup without filtering and processes the result using the do shortcode() function within TheFrontend::replace content(). Since the display name variable is editable by users via the core profile form, it can be manipulated to trigger this execution. If the affected page is a users collection, such as a team or member-directory page, the shortcode may execute for all visitors, including unauthenticated users. This issue requires a published page with a Kirki element where dynamic content is bound to the display name user field.

Recommendations Update Kirki – Freeform Page Builder, Website Builder & Customizer to version 6.3.2 or later.