Threat database

The Advanced Popups WordPress plugin by codesupplyco contains a stored cross-site scripting (XSS) vulnerability in the 'Notification Button Link' field. This affects all versions up to and including 1.2.3. Authenticated users with author-level permissions or higher can inject malicious scripts that execute when other users view the affected pages.

The Powerkit WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its Lazy Load module's image processing. This flaw exists in all versions up to and including 3.0.4 and arises from improper input neutralization in the 'content_process_images' function. Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.

CVE-2026-28178 is a medium severity cross-site scripting (XSS) vulnerability affecting codesupplyco Powerkit versions up to and including 3.1.0. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute script code in the context of another user. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-39559 is a high severity vulnerability affecting codesupplyco's Uppercase product versions prior to 1.2.2. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication. The vulnerability has a CVSS 3.1 base score of 8.1, indicating a high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codesupplyco Networker networker allows PHP Local File Inclusion.This issue affects Networker: from n/a through <= 1.2.0.

The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_reload_nav_menu() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to modify the location of display menus.