Junglewise Threat Intelligence

CVE-2026-15644: Powerkit WordPress plugin Stored XSS in style shortcode attribute

CVE-2026-15644 · Severity: medium · CVSS 6.4 · Published 2026-08-01

Executive brief

The Powerkit plugin for WordPress, which adds various functional elements to websites, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute automatically when other users, including site administrators, visit the affected pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Powerkit WordPress plugin due to insufficient input sanitization and output escaping of the 'style' attribute within its shortcode implementation. Authenticated attackers with contributor-level privileges or higher can exploit this by embedding malicious JavaScript into a post or page via the shortcode. When the page is viewed by other users, the script executes in their browser context. The vulnerability is present in all versions up to and including 3.1.0. A patch has been released in subsequent versions (referenced in changeset 3629599).

Affected products

  • codesupplyco Powerkit – Supercharge your WordPress Site <= 3.1.0

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References

Related threats