CVE-2026-28178 codesupplyco CVE debrief

Who should care

Users of Powerkit plugin version 3.1.0 or earlier, WordPress site administrators, and security teams monitoring for XSS vulnerabilities should be aware of this vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Affected operator, platform, vulnerability-management, and security-team impact should be considered when planning vendor-supported updates or mitigations.

Technical summary

CVE-2026-28178 is a Cross Site Scripting (XSS) vulnerability in Powerkit plugin versions <= 3.1.0. The vulnerability requires contributor-level access for exploitation, with a CVSS score of 6.5 and medium severity. It affects users of Powerkit plugin version 3.1.0 or earlier, WordPress site administrators, and security teams monitoring for XSS vulnerabilities.

Defensive priority

Medium-severity XSS vulnerability in Powerkit plugin

Recommended defensive actions

• Inventory and verify Powerkit plugin version
• Apply vendor patch or upgrade to a non-vulnerable version
• Monitor for suspicious activity
• Restrict contributor access

Evidence notes

Evidence from Patchstack and NVD indicates a Cross Site Scripting (XSS) vulnerability exists in Powerkit plugin versions <= 3.1.0. Contributor-level access is required for exploitation. The vulnerability has a CVSS score of 6.5 and medium severity. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources