Powerkit – Supercharge your WordPress Site

3.1.1

• Security fix: patched Stored XSS in the Separator shortcode ‘style’ attribute (CVE-2026-15644). The value is now validated against the list of CSS border styles.
• Security fix: patched Stored XSS in the Progress Bar shortcode ‘height’, ‘value’ and ‘color’ attributes. Dimensions are cast to numbers and the color is sanitized as a CSS class name.
• Security fix: patched Stored XSS in the Progress Bar shortcode when “Display value” is enabled — the value was written into the page as HTML instead of text.
• Security fix: patched Stored XSS in the Tabs shortcode ‘nav’ and ‘type’ attributes. Both are now sanitized as CSS class names.
• All four issues required contributor-level access or above. Rendering of existing content is unchanged.
• Security hardening: the author name in post meta and the admin-only warning notices are now filtered before output, so an error message returned by a remote API can no longer inject markup into an administrator’s screen.
• Security hardening: request values on the settings, Connect, Fonts, Custom Fonts, Post Format, Post Views, Featured Categories and Share Buttons admin screens are now consistently unslashed and sanitized. No change to any saved value.

3.1.0

• Improved PHP 8.1–8.3 compatibility: prevented a fatal error that could occur when a third-party plugin registers an invalid callback on a WordPress user-query hook (e.g. pre_user_query). The user lookup now fails safe instead of taking down the site.
• The Author Box and Contributors blocks no longer query the site’s user list on front-end requests — that list is only needed for the block editor’s author/contributor dropdown, so front-end pages are lighter and unaffected by that class of third-party errors.

3.0.9

• Security fix: patched Stored XSS in the Slider and Justified Gallery shortcode attributes (attribute values are now escaped on output — same class of issue as CVE-2026-2390)
• Security fix: added a capability check to the module activate/deactivate handler so only administrators can toggle modules
• Security fix: added capability checks to the Opt-In Forms integration-refresh AJAX handlers (Kit, MailChimp, MailerLite)
• Security improvement: added capability checks to the Post Format UI gallery/oEmbed AJAX handlers, restricted the Table of Contents preview REST route to editors, and escaped the Table of Contents anchor-link URL

3.0.8

• Added compatibility with WordPress 7.0
• Moved all Powerkit settings pages under a single Powerkit menu (fixes duplicate “Fonts” and “Connect” menu items in WordPress 7.0)
• Improved security and code quality: output escaping, input sanitization, prepared database queries, and direct file access protection (WordPress Plugin Check compliance)
• Updated icon font for improved compatibility
• Fixed Scroll to Top button visibility with overlapping elements

3.0.7

• Security improvement: apply esc_attr() to all attribute values in Lazy Load image reconstruction (defense in depth, follow-up to CVE-2026-2390)

3.0.6

• Improved performance: Tippy script is now loaded only for logged-in users