The Powerkit – Supercharge your WordPress Site plugin is vulnerable to stored cross‑site scripting (CWE‑79) through shortcode attributes. Insufficient input sanitization and output escaping allow an authenticated attacker with Contributor access or higher to embed arbitrary JavaScript, which is then rendered to all visitors of the affected page. The injected script runs in the victim's browser, enabling actions such as credential theft, session hijacking, or site defacement.

All releases of the Powerkit plugin up to and including version 3.1.0 are affected. The plugin is distributed by Code Supply Co for WordPress and is commonly used to add advanced widgets to sites. Sites running any of these versions that include the Basic‑Elements module are susceptible to the stored‑XSS flaw.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of <1 % reflects a very low but nonzero likelihood of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires only that the attacker has read/write permissions to the plugin’s shortcode editor, which is granted to contributors or higher. Once the script is stored, it will execute automatically in the browser of any user who views the injected content.