Kirki – Freeform Page Builder, Website Builder & Customizer (<= 6.3.2)

The Kirki WordPress plugin is vulnerable to PHP Object Injection in versions 6.3.2 and earlier, allowing authenticated users with Editor or Administrator access to trigger deserialization of untrusted input.