Is CVE-2026-15645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15645 being exploited in the wild.

How severe is CVE-2026-15645?

Medium severity, with a CVSS score of 6.4, published 1 August 2026.

Which products and versions are affected?

Code Supply Co. Powerkit up to, and including, 3.1.0.

Is there a fix for CVE-2026-15645?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15645 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15645?

Check whether you run Code Supply Co. Powerkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15645: codesupplyco Powerkit Stored XSS in nav shortcode attribute

CVE-2026-15645 · Severity: medium · CVSS 6.4 · Published 2026-08-01

Powerkit is a WordPress plugin used to add various features and design elements to websites. A security flaw in the plugin allows users with basic editing permissions (like contributors) to inject malicious scripts into website pages. When other users, including site administrators or visitors, view these pages, the scripts will run in their browsers, potentially leading to unauthorized actions or data theft.

Technologies: Code Supply Co. Powerkit. Vendors: Code Supply Co..

Quick answers

Is CVE-2026-15645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15645 being exploited in the wild.
How severe is CVE-2026-15645?: Medium severity, with a CVSS score of 6.4, published 1 August 2026.
Which products and versions are affected?: Code Supply Co. Powerkit up to, and including, 3.1.0.
Is there a fix for CVE-2026-15645?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15645 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15645?: Check whether you run Code Supply Co. Powerkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize and escape the 'nav' attribute within its shortcode implementation. This vulnerability is located in the basic-elements module, specifically within the tabs template and public class files. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary JavaScript into a page via the shortcode. The script executes in the context of any user who subsequently views the affected page. The issue is addressed in the changeset 3629599.

Affected products

codesupplyco Powerkit – Supercharge your WordPress Site up to, and including, 3.1.0

Timeline

2026-08-01: disclosed
2026-08-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.