Stored Cross-Site Scripting in Powerkit Plugin for WordPress
CVE-2026-15649

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Powerkit – Supercharge Your WordPress Site
Vendor
CVE Published:
1 August 2026

What is CVE-2026-15649?

The Powerkit plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequacies in input sanitization and output escaping. This vulnerability allows authenticated attackers, possessing contributor-level access or higher, to embed arbitrary scripts through shortcode attributes. When users visit the compromised pages, these malicious scripts execute, jeopardizing user data and potentially enabling unauthorized actions within the website.

Affected Version(s)

Powerkit – Supercharge your WordPress Site 0 <= 3.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/powerkit/tags/...
https://plugins.trac.wordpress.org/browser/powerkit/tags/...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.