Kirki – Freeform Website Builder & Customizer

kirki · by themeum · wordpress.org ↗ · SVN ↗
Active installs
500k+
Current version
6.0.2
Added
2014-05-27
Last updated
2026-04-30 (2d ago)
First seen by beacon
11d ago
Total downloads
12,504,010

Alerts (0)

No open alerts.

Show 3 resolved alerts
High committer_younger_than_plugin Resolved · benign_company_employee 2026-04-27 10:32:30 (5d ago)
Slugkirki
Committer slugdeployer
Committer display namedeployer.seravo.com
Committer employer
Committer member since2015-08-08
Committer first commit2016-03-20 19:52:01
Committer commit count2
Plugin listed authorthemeum
Earliest plugin commit2014-05-27 21:36:58
Plugin age at join days662
Committer age at join days225
Active installs500,000
View raw JSON
{
    "slug": "kirki",
    "committer_slug": "deployer",
    "committer_display_name": "deployer.seravo.com",
    "committer_employer": null,
    "committer_member_since": "2015-08-08",
    "committer_first_commit": "2016-03-20 19:52:01",
    "committer_commit_count": 2,
    "plugin_listed_author": "themeum",
    "earliest_plugin_commit": "2014-05-27 21:36:58",
    "plugin_age_at_join_days": 662,
    "committer_age_at_join_days": 225,
    "active_installs": 500000
}
Critical code_pattern Resolved · no_longer_matches 2026-04-24 17:01:47 (7d ago)
Slugkirki
Patternunserialize_after_remote_call
Kindbuiltin
Version5.2.3
Hit count3
First hit
File
customizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php
Line
545
Snippet
L527: $request = wp_remote_post( → L545: $request->sections = maybe_unserialize( $request->sections );
Explanationa remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak.
View raw JSON
{
    "slug": "kirki",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "5.2.3",
    "hit_count": 3,
    "first_hit": {
        "file": "customizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php",
        "line": 545,
        "snippet": "L527: $request = wp_remote_post(  \u2192  L545: $request->sections = maybe_unserialize( $request->sections );"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak."
}
Critical code_scan_delta Resolved · fp_edd_updater_library 2026-04-24 15:52:51 (7d ago)
Slugkirki
Previous version5.2.3
Current version5.2.3
New findings
PatternKindFileLineSnippetConfidence
unserialize_after_remote_callbuiltincustomizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php545L527: $request = wp_remote_post( → L545: $request->sections = maybe_unserialize( $request->sections );high
unserialize_after_remote_callbuiltincustomizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php551L542: $request = json_decode( wp_remote_retrieve_body( $request ) ); → L551: $request->banners = maybe_unserialize( $request->banners );high
unserialize_after_remote_callbuiltincustomizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php555L542: $request = json_decode( wp_remote_retrieve_body( $request ) ); → L555: $request->icons = maybe_unserialize( $request->icons );high
New finding count3
View raw JSON
{
    "slug": "kirki",
    "previous_version": "5.2.3",
    "current_version": "5.2.3",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "customizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php",
            "line": 545,
            "snippet": "L527: $request = wp_remote_post(  \u2192  L545: $request->sections = maybe_unserialize( $request->sections );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "customizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php",
            "line": 551,
            "snippet": "L542: $request = json_decode( wp_remote_retrieve_body( $request ) );  \u2192  L551: $request->banners = maybe_unserialize( $request->banners );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "customizer/packages/controls/tabs/edd/EDD_SL_Plugin_Updater.php",
            "line": 555,
            "snippet": "L542: $request = json_decode( wp_remote_retrieve_body( $request ) );  \u2192  L555: $request->icons = maybe_unserialize( $request->icons );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 3
}

SVN committers (5)

Accounts with actual commit access to kirki on plugins.svn.wordpress.org, reconstructed from svn log. This is the list that matters for ownership changes — not the readme contributors.

Committer Member since Commits First commit Latest commit
Ari Stathopoulos 2009-12-06 154 2014-05-27 · r922012 2020-04-20 · r2287539
David Vongries 2016-06-16 32 2020-04-23 · r2290025 2023-02-08 · r2862173
deployer.seravo.com 2015-08-08 2 2016-03-20 · r1375134 2016-03-23 · r1377260
plugin-master 2007-03-09 1 2014-05-27 · r921954 2014-05-27 · r921954
Themeum 2014-03-12 1 2023-05-18 · r2914504 2026-04-30 · r3519620

Readme contributors (1)

Names the plugin's readme declares as contributors. A soft signal — anyone can be listed. The SVN access column is the ground-truth cross-reference: does this contributor actually commit code?

Contributor Member since SVN access Status
Themeum 2014-03-12 1 commits Active

Versions (34 most recent)

Version Released Download
6.0.2 2026-04-30 · 2d ago zip
6.0.1 2026-04-29 · 2d ago
6.0.0 2026-04-29 · 3d ago zip
5.2.3 2026-04-10 · 22d ago zip
5.2.2 2026-02-17 · 2mo ago zip
5.2.1 2026-02-10 · 2mo ago zip
5.2.0 2026-02-09 · 2mo ago zip
5.1.1 2025-12-01 · 5mo ago zip
5.1.0 2024-03-22 · 2y ago zip
5.0.0 2023-08-04 · 2y ago zip
4.2.0 2023-07-13 · 2y ago zip
4.1 2023-05-18 · 2y ago zip
4.0.24 2022-05-25 · 3y ago zip
4.0.23 2022-03-22 · 4y ago zip
4.0.22 2022-03-07 · 4y ago zip
4.0.21 2022-02-11 · 4y ago zip
4.0.20 2022-02-07 · 4y ago zip
4.0.19 2022-02-07 · 4y ago zip
3.1.9 2021-07-19 · 4y ago zip
3.1.8 2021-07-01 · 4y ago zip
3.1.7 2021-06-21 · 4y ago zip
3.1.6 2020-12-07 · 5y ago zip
3.1.5 2020-08-10 · 5y ago zip
3.1.4 2020-07-11 · 5y ago zip
3.1.3 2020-05-19 · 5y ago zip
3.1.2 2020-05-10 · 5y ago zip
3.1.1 2020-04-05 · 6y ago zip
3.1.0 2020-03-01 · 6y ago zip
3.0.45 2019-09-01 · 6y ago zip
3.0.44 2019-06-25 · 6y ago zip
3.0.43 2019-06-16 · 6y ago zip
3.0.42 2019-06-16 · 6y ago zip
3.0.41 2019-06-13 · 6y ago zip
3.0.40 2019-06-02 · 6y ago zip