The vulnerability arises from inadequate sanitization of the 'style' attribute within the user–friendly Shortcode provided by the Powerkit plugin. An authenticated user with contributor or higher privileges can insert arbitrary JavaScript that is stored in the database and later rendered when any visitor loads the affected page. The injected script can hijack user sessions, steal cookies, deface content, or load additional malicious payloads.

All releases of the Powerkit – Supercharge your WordPress Site plugin up to and including version 3.1.0 are affected. The plugin is distributed by CodeSupplyCo and is commonly installed on WordPress sites that have enabled the Basic Elements or Separators modules, which provide the shortcode rendering that is vulnerable. Based on the provided references, the mention of these modules is inferred.

The CVSS score of 6.4 classifies the flaw as moderate. The EPSS score of less than 1 % indicates that widespread exploitation is unlikely at the present time, and the vulnerability is not yet listed in the CISA KEV catalog. However, because the flaw can be triggered only by authenticated contributors or higher, sites that grant those roles to large numbers of users or use shared credentials may be at higher risk. An attacker who successfully injects a payload could affect all website visitors, so mitigations should be applied promptly.