CVE-2026-17037

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the comment parameter, which execute when a user accesses the affected page.

Recommendations Update Kirki – Freeform Page Builder, Website Builder & Customizer to version 6.2.1 or later. As a temporary workaround, restrict the use of the comment parameter until the update is applied.