Powerkit vulnerabilities
4 known CVE vulnerabilities in Powerkit, translated and rated.
- CVE-2026-28178Medium
Cross Site Scripting (XSS) vulnerability in Powerkit versions up to 3.1.0 allows a Contributor user to inject malicious script.
- CVE-2026-15649Medium
The Powerkit plugin for WordPress is vulnerable to stored XSS via shortcode attributes. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
- CVE-2026-15645Medium
The Powerkit plugin for WordPress is vulnerable to stored XSS via the 'nav' shortcode attribute. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
- CVE-2026-15644Medium
The Powerkit plugin for WordPress is vulnerable to stored XSS via the 'style' shortcode attribute. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.