Skip to content
PluginCanary

Kirki - Freeform Page Builder, Website Builder & Customizer

by Themeum · 400,000+ active installs · Checked 3 Nov 2026
Healthy23 Warnings

Healthy: vulnerability published 26 Oct 2026, fixed in 6.3.0.

81/ 100 Canary Score
Sub-scores for Kirki - Freeform Page Builder, Website Builder & Customizer
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 26 Oct 2026, fixed in 6.3.0. Update to version 6.3.0 or later.26 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 16 Oct 2026, fixed in 6.4.0. Update to version 6.4.0 or later.16 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 16 Oct 2026, fixed in 6.4.0. Update to version 6.4.0 or later.16 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 14 Oct 2026, fixed in 6.2.1. Update to version 6.2.1 or later.14 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 6.3.2. Update to version 6.3.2 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 6.3.2. Update to version 6.3.2 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 6.3.2. Update to version 6.3.2 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 6 Oct 2026, fixed in 6.3.2. Update to version 6.3.2 or later.6 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 6.3.2. Update to version 6.3.2 or later.1 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 23 Sep 2026, fixed in 6.2.1. Update to version 6.2.1 or later.23 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 18 Sep 2026, fixed in 6.3.1. Update to version 6.3.1 or later.18 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 10 Sep 2026, fixed in 6.2.1. Update to version 6.2.1 or later.10 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 9 Sep 2026, fixed in 6.3.0. Update to version 6.3.0 or later.9 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 8 Sep 2026, fixed in 6.3.0. Update to version 6.3.0 or later.8 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 5 Sep 2026, fixed in 6.3.0. Update to version 6.3.0 or later.5 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 5 Sep 2026, fixed in 6.3.0. Update to version 6.3.0 or later.5 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 26 Aug 2026, fixed in 6.0.14. Update to version 6.0.14 or later.26 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 24 Aug 2026, fixed in 6.2.1. Update to version 6.2.1 or later.24 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 21 Aug 2026, fixed in 6.2.3. Update to version 6.2.3 or later.21 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 18 Aug 2026, fixed in 6.2.5. Update to version 6.2.5 or later.18 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 15 Aug 2026, fixed in 6.2.0. Update to version 6.2.0 or later.15 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 15 Aug 2026, fixed in 6.2.0. Update to version 6.2.0 or later.15 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 6.2.1. Update to version 6.2.1 or later.10 Aug 2026Evidence
  • InfoSEC-342 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
aristath27 May 2014 to 20 Apr 2020, 262 commits
davidvongries23 Apr 2020 to 8 Feb 2023, 32 commits
themeum18 May 2023 to 28 Oct 2026, 51 commits

3 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
7 days ago
Releases, 24 months
33
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Kirki - Freeform Page Builder, Website Builder & Customizer
Q1 20241
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 20251
Q1 20263
Q2 202614
Q3 202613
Q4 20262

Last release 28 Oct 2026. Tested with WordPress 7.1 (current).

Support

33% of 3 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
26 Oct 2026Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint8.8<= 6.2.56.3.00
16 Oct 2026Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter7.5<= 6.3.26.4.00
16 Oct 2026Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import7.2<= 6.3.26.4.00
14 Oct 2026Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content6.4<= 6.2.06.2.10
9 Oct 2026Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'5.4<= 6.3.16.3.20
9 Oct 2026Kirki <= 6.3.1 - Authenticated (Editor+) Server-Side Request Forgery5.5<= 6.3.16.3.20
9 Oct 2026Kirki <= 6.3.1 - Unauthenticated Arbitrary Shortcode Execution6.5<= 6.3.16.3.20
6 Oct 2026Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata7.2<= 6.3.16.3.20
1 Oct 2026Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution9.8<= 6.3.16.3.20
23 Sep 2026Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter5.4<= 6.2.06.2.10
18 Sep 2026Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting6.46.0.0 to 6.3.06.3.10
10 Sep 2026Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter7.2<= 6.2.06.2.10
9 Sep 2026Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Information Exposure5.36.2.1 to 6.2.56.3.00
8 Sep 2026Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Stored Cross-Site Scripting7.26.2.1 to 6.2.56.3.00
5 Sep 2026Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference4.36.0.0 to 6.2.56.3.00
5 Sep 2026Kirki – Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Editor+) SQL Injection4.96.0.0 to 6.2.56.3.00
26 Aug 2026Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.14 - Missing Authorization5.3< 6.0.146.0.140
24 Aug 2026Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.1 - Unauthenticated Remote Code Execution9.8< 6.2.16.2.10
21 Aug 2026Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting4.4< 6.2.36.2.30
18 Aug 2026Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting7.2<= 6.2.46.2.58
15 Aug 2026Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter4.3<= 6.1.16.2.00
15 Aug 2026Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter4.9<= 6.1.16.2.00
10 Aug 2026Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode6.4<= 6.2.06.2.10
4 Aug 2026Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection8.1< 6.0.136.0.130
31 Jul 2026Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)4.9<= 6.0.136.1.00

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Kirki - Freeform Page Builder, Website Builder & Customizer
Q3 20255.0
Q2 20263.0
Q3 20264.0

Average rating fell from 5.0 to 4.0 between Q3 2025 and Q3 2026.

Rating distribution
5 star68
4 star2
3 star2
2 star1
1 star8
Latest low reviews

Momentum

400,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Kirki - Freeform Page Builder, Website Builder & Customizer
4 May 2026124,026
11 May 2026145,802
18 May 2026391,747
25 May 202648,109
1 Jun 202632,543
8 Jun 2026124,585
15 Jun 2026138,283
22 Jun 2026138,886
29 Jun 2026134,345
6 Jul 202658,662
13 Jul 2026150,554
20 Jul 2026209,111
27 Jul 2026136,668
3 Aug 2026151,509
10 Aug 2026245,943
17 Aug 2026154,508
24 Aug 2026137,448
31 Aug 2026135,514
7 Sep 202630,639
14 Sep 2026138,010
21 Sep 202635,615
28 Sep 2026125,744
5 Oct 202645,848
12 Oct 2026125,845
19 Oct 202633,820
26 Oct 2026139,161
2 Nov 20265,334

Weekly downloads over the last 4 weeks are 38% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Fusion Page BuilderScore 87 · 3,000+SKT Page BuilderScore 87 · 2,000+Landing Page Builder - Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing PagesScore 86 · 8,000+Beaver Builder Page Builder - Drag and Drop Website BuilderScore 83 · 100,000+Colibri Page BuilderScore 83 · 80,000+

Facts

Version6.4.1
AuthorThemeum
Added27 May 2014
Last updated28 Oct 2026
Active installs400,000+
Requires WordPress5.9
Tested up to7.1.4
Requires PHP7.4
CategoryDesign & Themes > Page Builders & Visual Editors
Tagsform builder, page builder, drag-and-drop, freeform canvas, website builder

Other plugins by this author: Tutor LMS - eLearning and online course solution, Tutor LMS Elementor Addons, TutorMate, WP Mega Menu, Qubely - Advanced Gutenberg Blocks, WP Crowdfunding, Tutor LMS Divi Modules, Tutor LMS BunnyNet Integration, Tutor LMS - Migration Tool, Certificate customizer for Tutor LMS, Oxygen Tutor LMS, Growfund - Ultimate Donation & Crowdfunding Solution

Questions

Is Kirki - Freeform Page Builder, Website Builder & Customizer still maintained?

Kirki - Freeform Page Builder, Website Builder & Customizer was last updated on 28 Oct 2026. Its Canary status is Healthy.

Is Kirki - Freeform Page Builder, Website Builder & Customizer safe?

Kirki - Freeform Page Builder, Website Builder & Customizer has no open unpatched vulnerabilities on record. 42 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Kirki - Freeform Page Builder, Website Builder & Customizer?

The wordpress.org author is Themeum. Recent committers: themeum, davidvongries, aristath, deployer, plugin-master. We have recorded no ownership change.

What can I use instead of Kirki - Freeform Page Builder, Website Builder & Customizer?

Plugins in the same category with a higher Canary Score: Fusion Page Builder, SKT Page Builder, Landing Page Builder - Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages, Beaver Builder Page Builder - Drag and Drop Website Builder, Colibri Page Builder.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue