Skip to content
OpenAdvisories

Product · Code Supply Co.

Powerkit – Supercharge your WordPress Site

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-2390

    Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing

    The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attrib…

    Code Supply Co. Powerkit – Supercharge your WordPress Site Web / CMS
  • Medium 6.4
    CVE-2026-15644

    Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

    The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes…

    Code Supply Co. Powerkit – Supercharge your WordPress Site Web / CMS
  • Medium 6.4
    CVE-2026-15649

    Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it pos…

    Code Supply Co. Powerkit – Supercharge your WordPress Site Web / CMS
  • Medium 6.4
    CVE-2026-15645

    Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute

    The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes i…

    Code Supply Co. Powerkit – Supercharge your WordPress Site Web / CMS
  • Medium 6.4
    CVE-2024-2458

    Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

    The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplie…

    Code Supply Co. Powerkit – Supercharge your WordPress Site Web / CMS