Stored Cross-Site Scripting Vulnerability in Powerkit Plugin for WordPress

CVE-2026-2390

What is CVE-2026-2390?

The Powerkit plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through its Lazy Load module. This flaw arises from the 'content_process_images' function, which employs a faulty regex-based HTML attribute parser. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. Once injected, these scripts execute whenever a user visits the compromised page, potentially leading to data theft or further attacks on users.

References