Executive brief
Powerkit is a WordPress plugin used to add various features and design elements to websites. A security flaw in the plugin allows users with basic editing permissions (like contributors) to inject malicious scripts into website pages. When other users, including site administrators or visitors, view these pages, the scripts will run in their browsers, potentially leading to unauthorized actions or data theft.
Technical details
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize and escape the 'nav' attribute within its shortcode implementation. This vulnerability is located in the basic-elements module, specifically within the tabs template and public class files. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary JavaScript into a page via the shortcode. The script executes in the context of any user who subsequently views the affected page. The issue is addressed in the changeset 3629599.
Affected products
- codesupplyco Powerkit – Supercharge your WordPress Site up to, and including, 3.1.0
Timeline
- 2026-08-01: disclosed
- 2026-08-01: advisory
References
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/public/class-powerkit-basic-elements-public.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/templates/tabs.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/templates/tabs.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/public/class-powerkit-basic-elements-public.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/templates/tabs.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/templates/tabs.php
- https://plugins.trac.wordpress.org/changeset/3629599/powerkit