Description

Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T15:16:53.673Z",
  "pubdate": "2026-08-06T15:16:53.673Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the Powerkit plugin for WordPress, specifically affecting all versions up to and including 3.1.0. This security flaw is classified as a Contributor Cross-Site Scripting vulnerability, enabling authenticated users with low-level privileges, such as contributors, to inject malicious scripts into application contexts.\nThe primary impact of this vulnerability is the potential execution of arbitrary JavaScript within the context of a victim's browser session. When successfully exploited, an attacker could leverage this capability to hijack administrative sessions, steal sensitive user data, perform unauthorized actions on behalf of other users, or deface the affected web application.\nThe affected system is the Powerkit product in versions 3.1.0 and below. The risk implication is moderate to high depending on the privileges of the targeted users who view the injected content, typically requiring an authenticated attacker with contributor-level access to initiate the payload injection.\nNo complex exploitation requirements are mandated beyond possessing a valid user account with contributor capabilities on the target WordPress installation and enticing a higher-privileged user or administrator to render the malicious payload.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the Powerkit product in versions <= 3.1.0. Specifically, the component fails to properly sanitize, validate, or encode user-supplied data submitted by users assigned the contributor role before storing it in the database and subsequently rendering it within the administrative or front-end interface.\nCross-Site Scripting (XSS) occurs when an application includes untrusted data in a web page without proper validation or escaping, allowing malicious scripts to be executed by the browser. In this specific scenario, the root cause is deficient input sanitization combined with absent or inadequate context-aware output encoding on parameters processed by the vulnerable component.\nThe attack flow begins with an authenticated attacker possessing contributor-level privileges. The attacker crafts a malicious payload containing arbitrary JavaScript, encapsulated within HTML tags or event handlers, and submits this payload through vulnerable input vectors exposed by the Powerkit plugin.\nBecause the input filtering mechanisms do not adequately neutralize script tags or dangerous attributes, the malicious payload is successfully stored within the database. When an administrator or a privileged user navigates to the affected area of the application where the stored content is retrieved and displayed, the server reflects the unsanitized payload directly into the HTTP response.\nThe victim's browser parses the HTTP response and executes the embedded JavaScript payload within the security context of the victim's active session. This enables post-exploitation activities such as session hijacking via document.cookie theft, DOM manipulation, forced redirection to malicious external sites, or the automated creation of new administrative accounts via the WordPress REST API or administrative panels.\nAuthentication is strictly required to execute the initial injection phase, as the vulnerability relies on contributor-level privileges. The network exposure is remote, as exploitation is conducted via standard HTTP/HTTPS requests interacting with the vulnerable WordPress instance."
}