Powerkit – Supercharge your WordPress Site

Powerkit – Supercharge your WordPress Site has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (86%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 7 issues recorded for Powerkit – Supercharge your WordPress Site has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (3) reported by Wordfence PRISM. Powerkit – Supercharge your WordPress Site is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Powerkit – Supercharge your WordPress Site vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8

Powerkit < 2.5.9 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

7 records


2026-09-06 00:00	Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing Powerkit <= 3.0.4	`CVE-2026-2390`	6.4 Medium	Muhammad Yudha - DJ	Yes
2026-08-05 00:00	Powerkit – Supercharge your WordPress Site <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Powerkit <= 3.1.0	`CVE-2026-28178`	6.4 Medium	Ananda Dhakal	Yes
2026-07-31 19:55	Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute Powerkit <= 3.1.0	`CVE-2026-15644`	6.4 Medium	Wordfence PRISM	Yes
2026-07-31 19:47	Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Powerkit <= 3.1.0	`CVE-2026-15649`	6.4 Medium	Wordfence PRISM	Yes
2026-07-31 00:00	Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute Powerkit <= 3.1.0	`CVE-2026-15645`	6.4 Medium	Wordfence PRISM	Yes
2024-04-05 00:00	Powerkit – Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Powerkit <= 2.9.1	`CVE-2024-2458`	6.4 Medium	Francesco Carlucci	Yes
2022-01-11 00:00	Powerkit < 2.5.9 - Cross-Site Request Forgery Powerkit < 2.5.9	`N/A`	8.8 High	Anonymous	Yes

Showing 1–7 of 7 reports

Latestv3.1.1

Powerkit – Supercharge your WordPress Site

Author

codesupplyco

4.5(14)

90/100

Last Updated

2026-07-31 (1mo ago)

Active Installs

10,000+

Downloads

970,683

Requires WP

4.0+

Requires PHP

5.4+

Tested up to

WP 7.0.4

Created

2018-05-20 (8y ago)

We’ve been developing premium WordPress themes for a few years and have always been lacking essentials things in the WordPress core. There’re numerous plugins in the WordPress repository, however if you install them all, there’s inconsistency in their backend and frontend styles and possible plugin conflicts. That’s why we created Powerkit, essentials components for every WordPress blog or magazine. Components have modular structure and can be enabled or disabled with a single click. They have been thoroughly tested and play well together. Social Integrations Share Buttons Social Links Facebook Integration Pinterest Integration Twitter Integration Instagram Integration Marketing Opt-In Forms Content Presentation Basic Shortcodes Justified Gallery Slider Gallery Lightbox Typekit Fonts Custom Fonts Image Optimization Retina Images Lazyload Utilities Contributors Widget Author Widget Featured Posts Widget Scroll To Top Button

View on WordPress.org