CVE-2026-28178

Executive Summary

CVE-2026-28178 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress Powerkit plugin, affecting all versions up to and including 3.1.0. Authenticated users with Contributor-level privileges can inject malicious JavaScript that executes in the browsers of other users, including administrators, leading to session hijacking, privilege escalation, and full site compromise. A patch is claimed in version 3.1.1, though this has not been independently confirmed.

Technical Analysis

The vulnerability is a Contributor Cross-Site Scripting (XSS) flaw in the Powerkit plugin for WordPress. The NVD classification places this under CWE-79 (Improper Neutralization of Input During Web Page Generation), which indicates that the application fails to properly sanitize or escape user-supplied input before rendering it in a web page context.

Vulnerability Mechanism: The Powerkit plugin introduces a set of front-end components that render user-created content. The flaw lies in the plugin's failure to apply WordPress's built-in output escaping functions (such as esc_html(), esc_attr(), or wp_kses_post()) to certain data fields when rendering them. This allows an attacker with Contributor-level access — the lowest role capable of writing posts without review — to embed malicious HTML and JavaScript payloads.

Attack Surface: The attack surface is the WordPress web interface, specifically the post creation/editing functionality where Contributors can insert content that Powerkit components subsequently render. The vulnerability is triggered when a victim views a page containing the malicious content processed by Powerkit's rendering engine.

Contributor Privilege Context: The involvement of the Contributor role is significant. While Contributors cannot directly publish content, their pending submissions are often reviewed by Editors or Administrators. This creates a natural attack vector: a malicious Contributor submits content containing the XSS payload, and the vulnerability triggers when an administrator previews or reviews the submission.

Preconditions for Exploitation:

• The target site must have a WordPress installation with the Powerkit plugin (version ≤ 3.1.0) installed and active.
• The attacker must have a valid Contributor-level or higher account on the target WordPress site.
• A user with higher privileges (Editor or Administrator) must view the attacker-controlled content, either through the WordPress admin review interface or on the public site after publication.

Exploitation Scenarios

Attack Chain: Stored XSS via Contributor Submissions

Step 1 — Reconnaissance and Target Identification: The attacker identifies WordPress sites running the Powerkit plugin by fingerprinting the plugin's presence in page source, enqueued scripts (e.g., looking for Powerkit-specific JS/CSS file references), or by using search engines to find sites with distinctive Powerkit UI elements.

Step 2 — Account Acquisition: The attacker registers an account on the target site. As a new user, they typically receive the Subscriber role; however, sites that have enabled open registration with "Anyone can register" and set the "New User Default Role" to Contributor (a common configuration for community blogs) grant immediate Contributor access. Alternatively, the attacker may have compromised a legitimate Contributor account through credential stuffing or phishing.

Step 3 — Payload Weaponization: The attacker crafts a post containing JavaScript payload embedded in HTML. For example, within the post body, they include a script that executes on page load:

<script>
fetch('/wp-admin/admin-ajax.php', {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: 'action=add_meta&user_id=' + document.querySelector('#user_id').value +
        '&meta_key=wp_capabilities&meta_value=administrator'
});
</script>

Alternative payloads could capture administrator session cookies, force a password change, or inject a backdoor admin user.

Step 4 — Payload Delivery: The attacker submits the post with status "Pending Review." When an Editor or Administrator opens the WordPress admin dashboard to review pending posts, the Powerkit component renders the preview without sanitizing the embedded script. The payload executes in the context of the reviewing administrator's browser session.

Step 5 — Post-Exploitation Impact: With the JavaScript executing under the administrator's authenticated session, the attacker can:

• Create a new administrator-level account by sending crafted AJAX requests.
• Modify existing admin accounts' credentials and email addresses.
• Install malicious plugins or themes.
• Exfiltrate the admin session cookie via fetch() to an attacker-controlled server.
• Deploy web shells or backdoors for persistent access.

The stored nature of the XSS means the payload also executes for any site visitor who views the published malicious post, expanding the victim pool beyond the reviewing administrator to include all registered users (including other Contributors) and unauthenticated visitors.

Impact Assessment

CVSS Breakdown: The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L scores this at 6.5 (Medium severity):

• Attack Vector: Network (AV:N) — The vulnerability is exploitable remotely via the web interface.
• Attack Complexity: Low (AC:L) — No special conditions beyond standard browser interaction are required.
• Privileges Required: Low (PR:L) — Contributor-level access is sufficient.
• User Interaction: Required (UI:R) — The victim must render a page containing the malicious content.
• Scope: Changed (S:C) — The impact extends beyond the vulnerable component to the broader WordPress application.
• Confidentiality/Integrity/Availability Impact: Low (C:L/I:L/A:L) — Partial impact on all three security pillars.

Business Impact: For a WordPress site, this vulnerability transforms any registered Contributor account into a potential full site compromise vector. The requirement for Contributor-level access might seem limiting, but many WordPress sites with open registration and contributor-default settings drastically lower the barrier. A successful exploit can result in:

• Complete administrative takeover of the WordPress installation
• Defacement of the public website
• Data theft from the underlying database (user records, hidden content)
• Malware distribution to site visitors
• Damage to brand reputation and SEO rankings

Blast Radius: All WordPress instances running Powerkit ≤ 3.1.0, including blogs, corporate sites, and e-commerce platforms that leverage Powerkit's content enhancement features.

Detection Guidance

Sigma Rule

title: WordPress Powerkit Plugin CVE-2026-28178 Stored XSS Attempt
id: b7f1a3c5-8d42-4e19-9a5b-2f6c8d1e4a73
status: experimental
description: Detects creation of posts or pages containing script payloads targeting the Powerkit plugin vulnerable to stored XSS (CVE-2026-28178)
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
  category: application
  product: wordpress
detection:
  selection_post_creation:
    event_action:
      - post_created
      - post_updated
      - wp_insert_post
    post_status: pending
  selection_payload:
    post_content|contains:
      - '<script>'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'fetch('
      - 'XMLHttpRequest'
      - 'ajax.php'
      - 'document.cookie'
  condition: selection_post_creation and selection_payload
level: high
falsepositives:
  - Legitimate posts with embedded media or code snippets
  - Security plugins or themes that intentionally include script tags
tags:
  - attack.t1059
  - attack.initial-access
  - cve.2026-28178

YARA Rule

rule WordPress_Powerkit_CVE_2026_28178_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploit attempts and payloads associated with CVE-2026-28178, stored XSS in WordPress Powerkit plugin <= 3.1.0"
        date = "2026-05-15"
        cve = "CVE-2026-28178"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28178"
    strings:
        $powerkit_ref = /powerkit[-\/\\]*[\w\d\-\/\\]*\.(js|css)/ nocase
        $script_tag = "<script" ascii nocase
        $ajax_call = "admin-ajax.php" ascii nocase
        $fetch_call = "fetch(" ascii nocase
        $cookie_access = "document.cookie" ascii nocase
        $eval_call = "eval(" ascii nocase
        $onerror_handler = "onerror=" ascii nocase
        $xhr = "XMLHttpRequest" ascii nocase
    condition:
        uint16(0) == 0x3C3F and  // "<?"
        filesize < 1MB and
        $powerkit_ref and $script_tag and 2 of ($ajax_call, $fetch_call, $cookie_access, $eval_call, $onerror_handler, $xhr)
}

Suricata IDS Rule

alert http any any -> any any (
  msg:"ET WEB_SPECIFIC_APPS WordPress Powerkit CVE-2026-28178 Stored XSS Payload in Post Content";
  flow:established,to_server;
  content:"POST"; http_method;
  content:"content="; http_client_body;
  content:"<script"; http_client_body;
  nocase;
  content:"powerkit"; http_client_body;
  nocase;
  pcre:"/(admin-ajax\.php|document\.cookie|XMLHttpRequest|\.fetch\()/i";
  reference:cve,2026-28178;
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-28178;
  classtype:web-application-attack;
  sid:2026281781;
  rev:1;
  metadata:created_at 2026_05_15, updated_at 2026_05_15;
)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where event.category == "web" and
   network.protocol == "http" and
   http.request.method == "POST" and
   http.request.body.content contains "<script" and
   http.request.body.content contains "content="]
  [network where event.category == "web" and
   network.protocol == "http" and
   http.response.status_code >= 200 and
   http.response.status_code < 300]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST
| regex _raw="(?i)admin-ajax\.php|(?i)<script"
| regex _raw="(?i)powerkit"
| rex field=_raw "src_ip=(?P<src_ip>[^\s]+)"
| rex field=_raw "user_agent=(?P<user_agent>[^\s]+)"
| table _time src_ip user_agent uri_path status
| eval threat_name="CVE-2026-28178 WordPress Powerkit Stored XSS Attempt"
| stats count by _time src_ip user_agent threat_name
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,powerkit,xss,">
  <rule id="356594" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.category">web</field>
    <field name="http.request.method">POST</field>
    <match>admin-ajax\.php|content=.*&lt;script</match>
    <regex>powerkit</regex>
    <description>WordPress Powerkit plugin CVE-2026-28178 stored XSS payload detected in post content</description>
    <group>attack.t1059,attack.initial-access,</group>
    <mitre>
      <id>T1059</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations (to deploy within 24 hours):

• Verify whether your WordPress installation runs Powerkit ≤ 3.1.0 by navigating to Plugins → Installed Plugins in the WordPress admin dashboard and checking the Powerkit version. Alternatively, check wp-content/plugins/powerkit/readme.txt for the "Stable tag" value.
• If upgrade to 3.1.1+ is not immediately possible, temporarily deactivate the Powerkit plugin until the patch can be applied. This eliminates the vulnerability surface at the cost of losing Powerkit's features.
• Review and restrict account registration roles: If "Anyone can register" is enabled, set "New User Default Role" to Subscriber rather than Contributor or higher. This raises the minimum privilege an untrusted user can obtain.
• Audit existing Contributer and Author accounts. Suspend or downgrade accounts that appear dormant or unauthorized.

2. Patch/Upgrade Steps:

• Navigate to the WordPress Dashboard → Updates, and check for available updates for the Powerkit plugin.
• If version 3.1.1 or later is available, click "Update Now."
• If the update is not visible, manually download the latest version from the plugin's official repository or vendor website (https://wordpress.org/plugins/powerkit/ or the developer's site), then upload the ZIP via Plugins → Add New → Upload Plugin.
• After upgrading, immediately verify the installed version is ≥ 3.1.1 on the Plugins page.
• Monitor the CNA's advisory and vendor changelog to confirm the claimed patch resolves CVE-2026-28178. Since Patch Confidence is 2/4 (single source), validate the fix in a staging environment before declaring it reliable.

3. Long-Term Hardening:

• Implement a Web Application Firewall (WAF) with WordPress-specific rules to detect and block script injection attempts in post content, providing defense-in-depth beyond the eventual plugin patch.
• Enforce strict output escaping practices in any custom WordPress development by adhering to WordPress Coding Standards (esc_html(), esc_attr(), wp_kses_post()).
• Deploy a WordPress security plugin (e.g., Wordfence, Sucuri) that adds input sanitization layers and monitors for file modifications and suspicious admin activity.
• Establish a process for promptly applying security updates across all WordPress plugins, themes, and core, minimizing the window of exposure for known CVEs.
• For multi-site or managed WordPress environments, use a centralized patch management tool to push updates from a single point of control.

References

1. NVD Entry (Primary): https://nvd.nist.gov/vuln/detail/CVE-2026-28178 — Official NVD vulnerability record, containing the NVD description and assigned CVSS v3.1 vector and score (6.5).

2. CNA Advisory: Patchstack (the CNA for this CVE) — Advisory published at https://patchstack.com/database/vulnerability/powerkit — Details the affected version range (≤ 3.1.0) and the claimed fix in 3.1.1.

3. WordPress Plugin Repository: https://wordpress.org/plugins/powerkit/ — Official source for the patched version (3.1.1+) and changelog.

4. MITRE ATT&CK Framework: https://attack.mitre.org/techniques/T1059/ — Reference for the Command and Scripting Interpreter tactic, applied in the MITRE_TACTIC field of this report.

5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-28178 is not listed in the KEV catalog as of the report date; no confirmed in-the-wild exploitation has been reported to CISA.

Threat Actor Campaigns: As of the writing of this report, no specific threat actor campaigns have been publicly attributed to exploitation of CVE-2026-28178. The vulnerability is a standard Contributor-XSS flaw, creating a credible risk of exploitation in the wild given the prevalence of WordPress as a target and the public availability of exploit techniques. Security teams should proactively apply the mitigation guidance regardless of observed campaigns, as WordPress vulnerabilities of this class are routinely weaponized by opportunistic botnets and commercial exploit tooling.