Description

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-07T12:17:18.097Z",
  "pubdate": "2026-09-07T12:17:18.097Z",
  "executiveSummary": "The Powerkit plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability within its Lazy Load module. This vulnerability arises from inadequate input sanitization during image attribute processing, allowing authenticated users with Contributor-level privileges or higher to inject malicious JavaScript payloads. When these injected pages are rendered by other users, the arbitrary scripts execute within the context of their browsers. Successful exploitation can lead to unauthorized actions performed on behalf of legitimate users, potential session hijacking, and the compromise of site integrity. The vulnerability affects all versions of the Powerkit plugin up to and including 3.0.4. Given the requirement for Contributor-level access, the threat profile is primarily categorized as an authenticated privilege escalation or site-wide impact scenario where an attacker leverages legitimate access to execute unauthorized code on the platform.",
  "technicalDetails": "The root cause of this vulnerability is located within the 'content_process_images' function of the Powerkit plugin, which is responsible for processing image tags to enable lazy loading functionality. The function utilizes a flawed regular expression-based parser to identify and modify HTML attributes within image tags. Because this regex implementation fails to properly sanitize or validate user-supplied attributes, it permits the injection of malicious characters and script tags into the document object model (DOM).\nThe attack flow begins when an authenticated user with at least Contributor-level access creates or edits content within the WordPress environment. The attacker inserts a specially crafted image tag containing a malicious payload—such as an event handler (e.g., 'onerror' or 'onload')—within the 'src' or other attributes of an HTML 'img' tag. When the 'content_process_images' function parses this content, it incorrectly processes the malicious string, failing to escape or strip the injected JavaScript.\nOnce the post is saved, the malicious payload is stored permanently in the WordPress database. When any user—including administrators—views the infected post or page, the server delivers the stored malicious HTML content to the browser. The browser's parser then interprets the injected attribute as executable JavaScript code. Because this occurs in the context of the victim's session, the script operates with the permissions of the viewing user.\nThis vulnerability is particularly impactful because it does not require complex social engineering to trigger, as the script executes automatically upon page load. Post-exploitation impact includes the ability to steal sensitive session cookies, perform unauthorized administrative actions, redirect users to malicious domains, or deface the rendered content. Since the vulnerability is tied to the site's rendering process, any content processed by the Lazy Load module is susceptible to this manipulation. The reliance on regex-based parsing for security-sensitive HTML attribute handling is inherently fragile, as it fails to account for the complexities of HTML entity encoding and attribute manipulation that dedicated sanitization libraries are designed to manage."
}