CVE-2026-2390

COMPONENT VERSION RANGE

NewScan fingerprints powerkit from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-07. 6.4, and authenticated at Contributor level and above, which is why it is medium rather than high: `content_process_images` in the Lazy Load module parses HTML attributes with a flawed regex, so a contributor's post body survives into rendered pages as script that runs for every later visitor. Version source is the standard WordPress component route scan_wordpress already walks and needs no code: Powerkit enqueues its own assets as /wp-content/plugins/powerkit/<...>?ver=<plugin version>, which wordpress_tools.find_plugins keys by the directory slug `powerkit` (this row's key), refined where present by the plugin's readme.txt `Stable tag:`. The slug is confirmed, not guessed - NVD's own references for this CVE are plugins.trac.wordpress.org/browser/powerkit/trunk/modules/lazyload/... . NO `fixed_in` on purpose: NVD carries no CPE range for this id yet (vulnStatus Received) and neither the Wordfence entry nor the trac changeset (3604146, which answers 403 to an anonymous fetch) published a fixed version, so `le 3.0.4` is the vendor-stated affected bound and the row declines to assert a patch level it cannot source. Add `fixed_in` once the release is visible. Version-match only: confirming stored XSS would need Contributor credentials and a written post.