CVE-2026-28178 is a CWE-79 cross-site scripting vulnerability in codesupplyco Powerkit versions up to 3.1.0. The flaw arises from improper neutralization of input during web page generation, which can be exploited by a contributor-level user to execute arbitrary scripts in the context of the affected application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation could allow an attacker with contributor privileges to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability. The impact is rated medium severity with a CVSS score of 6.5. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor privileges and apply any recommended input validation or filtering controls if possible.