Powerkit – Supercharge your WordPress Site

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Powerkit – Supercharge your WordPress Site

Information

Software Type Plugin
Software Slug powerkit (view on wordpress.org)
Software Status Active
Software Author codesupplyco
Software Website wordpress.org
Software Downloads 972,140
Software Active Installs 10,000
Software Record Last Updated September 16, 2026

7 Vulnerabilities

Submit a Vulnerability
Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
6.4
CVE-2026-2390
Sep 6, 2026
Researcher: Muhammad Yudha - DJ
Powerkit – Supercharge your WordPress Site <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-28178
Aug 5, 2026
Researcher: Ananda Dhakal
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
6.4
CVE-2026-15644
Jul 31, 2026
Researcher: Wordfence PRISM
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-15649
Jul 31, 2026
Researcher: Wordfence PRISM
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute
6.4
CVE-2026-15645
Jul 31, 2026
Researcher: Wordfence PRISM
Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-2458
Apr 5, 2024
Researcher: Francesco Carlucci
Powerkit < 2.5.9 - Cross-Site Request Forgery
8.8
CVE ID Unknown
Jan 11, 2022
Researchers:
Title Status CVE ID CVSS Researchers Date
Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing Patched CVE-2026-2390 6.4 Muhammad Yudha - DJ September 6, 2026
Powerkit – Supercharge your WordPress Site <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2026-28178 6.4 Ananda Dhakal August 5, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute Patched CVE-2026-15644 6.4 Wordfence PRISM July 31, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Patched CVE-2026-15649 6.4 Wordfence PRISM July 31, 2026
Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute Patched CVE-2026-15645 6.4 Wordfence PRISM July 31, 2026
Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-2458 6.4 Francesco Carlucci April 5, 2024
Powerkit < 2.5.9 - Cross-Site Request Forgery Patched 8.8 January 11, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation