CVE-2026-16974

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1

Description Insufficient input sanitization and output escaping in the post meta Shortcode allow authenticated attackers with Contributor-level access or higher to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 6.2.0.