Is CVE-2026-15649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15649 being exploited in the wild.

How severe is CVE-2026-15649?

Medium severity, with a CVSS score of 6.4, published 1 August 2026.

Which products and versions are affected?

Code Supply Co. Powerkit – Supercharge your WordPress Site <= 3.1.0.

Is there a fix for CVE-2026-15649?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15649 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15649?

Check whether you run Code Supply Co. Powerkit – Supercharge your WordPress Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15649: Code Supply Co. Powerkit stored XSS via shortcode attributes

Q: Is there a fix for CVE-2026-15649?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-15649 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-15649?

Check whether you run Code Supply Co. Powerkit – Supercharge your WordPress Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15649 · Severity: medium · CVSS 6.4 · Published 2026-08-01

Powerkit is a WordPress plugin used to add various features and design elements to websites. A security flaw allows users with contributor-level access or higher to inject malicious scripts into website pages. These scripts will run automatically whenever any visitor or administrator views the affected page, potentially leading to unauthorized actions or data theft.

Vendors: Code Supply Co..

Quick answers

Is CVE-2026-15649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15649 being exploited in the wild.
How severe is CVE-2026-15649?: Medium severity, with a CVSS score of 6.4, published 1 August 2026.
Which products and versions are affected?: Code Supply Co. Powerkit – Supercharge your WordPress Site <= 3.1.0.
Is there a fix for CVE-2026-15649?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15649 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15649?: Check whether you run Code Supply Co. Powerkit – Supercharge your WordPress Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input in shortcode attributes. Specifically, the vulnerability exists within the 'basic-elements' module where shortcode attributes are not sufficiently sanitized before being rendered on the page. An authenticated attacker with contributor-level permissions or higher can exploit this by creating a post or page containing a malicious shortcode. When other users, including administrators, view the page, the injected script executes in their browser context. This can lead to session hijacking or unauthorized administrative actions. The issue is present in versions up to and including 3.1.0.

Affected products

Code Supply Co. Powerkit – Supercharge your WordPress Site <= 3.1.0

Timeline

2026-08-01: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.