Codesupplyco
Monthly
Local File Inclusion in the CodeSupply Co. 'Uppercase' WordPress theme versions prior to 1.2.2 allows remote unauthenticated attackers to include and disclose arbitrary local files from the web server, potentially leading to source code disclosure, credential theft, or remote code execution where log/upload poisoning is feasible. The flaw is tagged as LFI/PHP/Information Disclosure by Patchstack and carries a CVSS 8.1 (High) rating; no public exploit identified at time of analysis.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Stored Cross-Site Scripting in the Powerkit plugin for WordPress (all versions through 3.1.0) allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via shortcode attributes in the basic-elements module. The injected payload persists server-side and executes in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS Scope:Changed rating and Wordfence disclosure reflect meaningful cross-user impact.
Stored Cross-Site Scripting in the Powerkit - Supercharge Your WordPress Site plugin (versions up to and including 3.1.0) enables authenticated contributors to inject persistent malicious scripts via the 'nav' shortcode attribute that execute in any visitor's browser upon page load. Reported by Wordfence, the flaw originates in the tabs.php template and the public class handler where shortcode input is passed to output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed vector (S:C) indicates cross-user impact with a 6.4 medium-high base score.
Stored Cross-Site Scripting in the Canvas plugin for WordPress (versions ≤ 2.5.2) allows an authenticated attacker holding contributor-level access or above to inject persistent JavaScript via the unsanitized 'tag' parameter in the block-section-heading Gutenberg block. The payload is stored in the database and executes in the browser of any user who subsequently loads the compromised page, enabling session hijacking, credential theft, or malicious redirects at scale. No active exploitation is confirmed (not listed in CISA KEV), but the low privilege bar makes this a realistic threat on multi-author WordPress installations; a fix is available in version 2.5.3.
The Powerkit - Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Local File Inclusion in the CodeSupply Co. 'Uppercase' WordPress theme versions prior to 1.2.2 allows remote unauthenticated attackers to include and disclose arbitrary local files from the web server, potentially leading to source code disclosure, credential theft, or remote code execution where log/upload poisoning is feasible. The flaw is tagged as LFI/PHP/Information Disclosure by Patchstack and carries a CVSS 8.1 (High) rating; no public exploit identified at time of analysis.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Stored Cross-Site Scripting in the Powerkit plugin for WordPress (all versions through 3.1.0) allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via shortcode attributes in the basic-elements module. The injected payload persists server-side and executes in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS Scope:Changed rating and Wordfence disclosure reflect meaningful cross-user impact.
Stored Cross-Site Scripting in the Powerkit - Supercharge Your WordPress Site plugin (versions up to and including 3.1.0) enables authenticated contributors to inject persistent malicious scripts via the 'nav' shortcode attribute that execute in any visitor's browser upon page load. Reported by Wordfence, the flaw originates in the tabs.php template and the public class handler where shortcode input is passed to output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed vector (S:C) indicates cross-user impact with a 6.4 medium-high base score.
Stored Cross-Site Scripting in the Canvas plugin for WordPress (versions ≤ 2.5.2) allows an authenticated attacker holding contributor-level access or above to inject persistent JavaScript via the unsanitized 'tag' parameter in the block-section-heading Gutenberg block. The payload is stored in the database and executes in the browser of any user who subsequently loads the compromised page, enabling session hijacking, credential theft, or malicious redirects at scale. No active exploitation is confirmed (not listed in CISA KEV), but the low privilege bar makes this a realistic threat on multi-author WordPress installations; a fix is available in version 2.5.3.
The Powerkit - Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.