# CVE-2026-2390: WordPress Powerkit Stored Cross-Site Scripting in Lazy Load module

Source: https://junglewise.ai/threats/cve-2026-2390-wordpress-powerkit-stored-cross-site-scripting-in-lazy-load-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-2390 · Severity: medium · CVSS 6.4 · Published 2026-09-07

The Powerkit plugin for WordPress, widely used for site performance optimization, contains a flaw in its Lazy Load image processing feature that allows users with contributor-level permissions to inject malicious scripts into pages. When other users visit an affected page, the injected script automatically executes in their browser, potentially compromising their session, stealing credentials, or spreading malware through the site.

## Quick answers

**Is CVE-2026-2390 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2390 being exploited in the wild.

**How severe is CVE-2026-2390?** Medium severity, with a CVSS score of 6.4, published 7 September 2026.

**Which products and versions are affected?** Powerkit Powerkit up to and including 3.0.4.

**Is there a fix for CVE-2026-2390?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-2390 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2390?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This Stored Cross-Site Scripting (XSS) vulnerability exists in the 'content_process_images' function within the Lazy Load module, which uses a flawed regex-based HTML attribute parser. The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript code into page content. The injected payload persists in the database and executes in the browsers of all visitors viewing the compromised page. The vulnerability affects all versions up to and including 3.0.4, and patches addressing the regex parsing flaw should be available from the plugin vendor.

## Affected products

- Powerkit Powerkit up to and including 3.0.4

## Timeline

- 2026-09-07: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/powerkit/trunk/modules/lazyload/public/class-powerkit-lazyload-public.php](https://plugins.trac.wordpress.org/browser/powerkit/trunk/modules/lazyload/public/class-powerkit-lazyload-public.php)
- [https://plugins.trac.wordpress.org/browser/powerkit/trunk/modules/lazyload/public/class-powerkit-lazyload-public.php](https://plugins.trac.wordpress.org/browser/powerkit/trunk/modules/lazyload/public/class-powerkit-lazyload-public.php)