Executive brief
Powerkit is a WordPress plugin used to add various features and design elements to websites. A security flaw allows users with contributor-level access or higher to inject malicious scripts into website pages. These scripts will run automatically whenever any visitor or administrator views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input in shortcode attributes. Specifically, the vulnerability exists within the 'basic-elements' module where shortcode attributes are not sufficiently sanitized before being rendered on the page. An authenticated attacker with contributor-level permissions or higher can exploit this by creating a post or page containing a malicious shortcode. When other users, including administrators, view the page, the injected script executes in their browser context. This can lead to session hijacking or unauthorized administrative actions. The issue is present in versions up to and including 3.1.0.
Affected products
- Code Supply Co. Powerkit – Supercharge your WordPress Site <= 3.1.0
Timeline
- 2026-08-01: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/public/class-powerkit-basic-elements-public.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.0.9/modules/basic-elements/templates/progressbars.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/public/class-powerkit-basic-elements-public.php
- https://plugins.trac.wordpress.org/browser/powerkit/tags/3.1.0/modules/basic-elements/templates/progressbars.php
- https://plugins.trac.wordpress.org/changeset/3629599/powerkit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f86c6ada-112b-4b1f-b1ac-7dd4920953c8?source=cve