CVE-2026-2390: WordPress Powerkit Plugin XSS Vulnerability

CVE-2026-2390 Overview

CVE-2026-2390 is a Stored Cross-Site Scripting (XSS) vulnerability in the Powerkit plugin for WordPress. The flaw affects all versions up to and including 3.0.4. The content_process_images function in the Lazy Load module uses a flawed regex-based HTML attribute parser to process image tags. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. Injected scripts execute in the browser of any user who visits an affected page. The vulnerability is tracked under [CWE-79] and originates in the plugin's class-powerkit-lazyload-public.php file.

Critical Impact
Contributor-level accounts can persist JavaScript payloads in published content, enabling session theft, redirection, and defacement against visitors and administrators.

Affected Products

WordPress Powerkit plugin — all versions ≤ 3.0.4
Sites permitting Contributor-level or higher registration
WordPress installations with the Lazy Load module enabled

Discovery Timeline

2026-09-07 - CVE-2026-2390 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-2390

Vulnerability Analysis

The Powerkit Lazy Load module rewrites <img> tags in post content to support deferred image loading. The content_process_images function parses HTML attributes using regular expressions rather than a proper DOM parser. Regex-based HTML parsing cannot reliably handle malformed markup, nested quotes, or attribute injection edge cases. An attacker crafts image markup that the parser mis-tokenizes, allowing script-bearing attributes to survive the rewrite. The resulting output includes attacker-controlled JavaScript that executes when the page renders. See the Wordfence Vulnerability Report for the full write-up.

Root Cause

The root cause is unsafe HTML attribute parsing in content_process_images. The regex-based approach fails to normalize or sanitize attributes before re-emitting them, producing output that reintroduces attacker-controlled script content into rendered pages.

Attack Vector

An authenticated Contributor submits a post or page containing crafted image markup. When an editor previews or a visitor loads the published page, the Lazy Load module processes the image and emits the tainted attributes. The payload executes in the visitor's browser under the site's origin. Because the injection persists in stored content, every subsequent viewer is affected until the content is removed or the plugin is patched.

No verified exploit code has been published. See the WordPress plugin source at line 227 for the vulnerable parser implementation.

Detection Methods for CVE-2026-2390

Indicators of Compromise

Unexpected <script> tags or on* event handler attributes inside stored post or page content.
Image tags containing encoded quotes, backslashes, or nested attribute values that survived plugin processing.
Outbound requests from visitor browsers to unfamiliar domains after loading pages authored by Contributor accounts.

Detection Strategies

Audit wp_posts for content containing javascript:, onerror=, onload=, or inline <script> blocks authored by non-Administrator users.
Review Powerkit plugin version data via wp plugin list and flag installations at or below 3.0.4.
Correlate Contributor content submissions with client-side errors or Content Security Policy (CSP) violations reported by browsers.

Monitoring Recommendations

Enable web server logging for POST requests to /wp-admin/post.php and monitor for suspicious payloads from Contributor accounts.
Deploy a Content Security Policy that reports inline script execution violations to a monitored endpoint.
Track newly created or modified posts by low-privilege accounts and route them for editorial review before publication.

How to Mitigate CVE-2026-2390

Immediate Actions Required

Update the Powerkit plugin to a version above 3.0.4 that includes WordPress Changeset #3604146.
Audit existing Contributor and Author accounts and remove or downgrade accounts that are not required.
Review recently published posts and pages for injected script content and revert or sanitize affected entries.

Patch Information

The vendor addressed the flaw in WordPress Changeset #3604146. Site administrators should upgrade to the fixed release through the WordPress plugin manager or by deploying the patched files directly.

Workarounds

Disable the Powerkit Lazy Load module until the plugin is updated.
Restrict content submission privileges so untrusted users cannot reach Contributor or higher roles.
Enforce a strict Content Security Policy that blocks inline script execution and unknown script origins.

bash

# Configuration example - disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate powerkit
wp plugin list --name=powerkit --fields=name,status,version