CVE-2026-102291 Details

A vulnerability allowing arbitrary shortcode execution has been identified in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions through 6.3.1. The issue arises because the plugin injects a user's 'display_name' into the page markup without proper filtering, and then processes the entire output with 'do_shortcode()' in the 'TheFrontend::replace_content()' method. Since 'display_name' can be modified by any user through the WordPress profile form, this vulnerability enables authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes. If the affected page is a user collection, such as a team or member directory, the executed shortcode will run in the context of every visitor, including those who are not authenticated. Exploitation requires a published page containing a Kirki element linked to the 'display_name' user field.

Users are advised to update the Kirki – Freeform Page Builder, Website Builder & Customizer plugin to version 6.3.2 or a newer patched version.