medium
CVE-2026-2390
Powerkit (WordPress) stored cross-site scripting via the Lazy Load module's regex-based image-attribute parser
- Severity
- medium
- Affected product
- powerkit
- Affected versions
- powerkit ≤ 3.0.4
- Detection basis
- Component version range
- Shipped rule
- powerkit: Powerkit (WordPress) stored cross-site scripting via the Lazy Load module's regex-based image-attribute parser
- Added to NewScan
- 2026-09-07
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints powerkit from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.