Vulnerabilities and security researches forpowerkit powerkit

Jun 07, 2024

CVE, Research URL: 651773caee97284f971c78d7c30cc185e75c1a1d
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Feb 16, 2022
Research Description: Powerkit – Supercharge your WordPress Site [powerkit] < 2.5.9 WordPress Powerkit plugin <= 2.5.8 - Post Views Settings Update/Reset via Cross-Site Request Forgery (CSRF) vulnerability Post Views Settings Update/Reset via Cross-Site Request Forgery (CSRF) vulnerability discovered by Jan w Oleju in WordPress Powerkit plugin (versions <= 2.5.8).
Affected versions: max 2.5.9.
Status: vulnerable

CVE, Research URL: CVE-2024-2458
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Apr 06, 2024
Research Description: The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 2.9.2.
Status: vulnerable

Jun 16, 2026

CVE, Research URL: 06b65a292c0f1e22e025ab1ca9c8f1d1af57e31b
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Jan 11, 2022
Research Description: Powerkit – Supercharge your WordPress Site [powerkit] < 2.5.9 Powerkit < 2.5.9 - Cross-Site Request Forgery The Powerkit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.8 This is due to missing or incorrect nonce validation on an unknown function. Unauthenticated attackers may be able to conduct unspecified attacks (such as Cross-Site Scripting) via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 2.5.9.
Status: vulnerable

CVE, Research URL: de9a0c29-64d1-41f3-b97c-ad9f8b811954
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: -
Research Description: Powerkit – Supercharge your WordPress Site [powerkit] < 2.5.9 Powerkit < 2.5.9 - Post Views Settings Update/Reset via CSRF The plugin does not have CSRF checks when saving or reseting its post views settings, which could allow an attacker to make a logged in admin change or reset them via a CSRF attack
Affected versions: max 2.5.9.
Status: vulnerable

Aug 02, 2026

CVE, Research URL: CVE-2026-15644
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Aug 01, 2026
Research Description: The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.1.1.
Status: vulnerable

CVE, Research URL: CVE-2026-15649
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Aug 01, 2026
Research Description: The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.1.1.
Status: vulnerable

CVE, Research URL: CVE-2026-15645
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Aug 01, 2026
Research Description: The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.1.1.
Status: vulnerable

Aug 08, 2026

CVE, Research URL: CVE-2026-28178
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Aug 06, 2026
Research Description: Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
Affected versions: max 3.1.1.
Status: vulnerable

Sep 08, 2026

CVE, Research URL: CVE-2026-2390
Home page URL: Security reports for Powerkit – Supercharge your WordPress Site
Application: Powerkit – Supercharge your WordPress Site
Date: Sep 07, 2026
Research Description: The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.0.5.
Status: vulnerable