What is the CVSS score of CVE-2026-28178?

CVE-2026-28178 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Powerkit WordPress Plugin CVE-2026-28178

EUVD-2026-53950 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-qgq3-gccq-65hq

WordPress XSS Powerkit Wordpress Plugin Codesupplyco

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L confirmed by contributor-role requirement; UI:R because a victim must view content; A:N because XSS does not directly impact availability.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:59 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.

AnalysisAI

Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.

Technical ContextAI

Powerkit (CPE: cpe:2.3:a:codesupplyco:powerkit:*:*:*:*:*:*:*:*) is a WordPress plugin by codesupplyco providing content enhancement features such as shortcodes, widgets, and page builder elements. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input from contributor-role accounts is not properly sanitized or escaped before being rendered in HTML output. In WordPress's role model, contributors can create and submit posts but cannot publish - however, injected XSS payloads in saved draft content can still execute when an editor or administrator previews or publishes that content, making the contributor vector a meaningful privilege escalation path.

RemediationAI

The primary remediation is to update the Powerkit plugin to a version newer than 3.1.0. The exact fixed release version is not confirmed in the available data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/powerkit/vulnerability/wordpress-powerkit-plugin-3-1-0-cross-site-scripting-xss-vulnerability should be consulted for the confirmed patched version. Upstream fix availability as a released, tagged version has not been independently verified from the provided references. As a compensating control where immediate patching is not feasible, site administrators should audit which users hold Contributor roles and reduce that set to only fully trusted accounts, since exploitation requires an authenticated contributor. Enabling a Web Application Firewall (WAF) rule targeting XSS payloads in WordPress post content can reduce but not eliminate risk. Do not rely on browser-side XSS filtering alone, as modern browsers have deprecated built-in XSS auditors.