CVE-2026-15645 in Powerkit Plugin
Summary
by MITRE • 08/01/2026
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The Powerkit plugin for WordPress represents a significant security vulnerability through its stored cross-site scripting flaw in the 'nav' shortcode attribute. This vulnerability affects all versions up to and including 3.1.0, creating a persistent threat vector that can be exploited by authenticated attackers possessing contributor-level privileges or higher. The flaw stems from inadequate input sanitization mechanisms and insufficient output escaping procedures within the plugin's code implementation.
The technical nature of this vulnerability allows malicious actors to inject arbitrary web scripts into pages through the navigation shortcode parameter. When legitimate users access these compromised pages, the injected scripts execute in their browsers, potentially leading to session hijacking, data theft, or further exploitation of the victim's privileges. This stored XSS vulnerability operates by persisting the malicious payload within the WordPress database rather than relying on reflected attacks that require user interaction with specific URLs.
From an operational perspective, this vulnerability poses a serious risk to WordPress sites using Powerkit plugin, as it requires only contributor-level access to exploit. This privilege level is often granted to users who contribute content or manage their own posts, making the attack surface broader than initially apparent. The impact extends beyond simple script execution, potentially enabling attackers to escalate privileges, steal administrator credentials, or manipulate site content through more sophisticated attack chains that leverage the initial XSS vector.
The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in web applications, and demonstrates characteristics consistent with ATT&CK technique T1566.002 related to Spearphishing Attachments. Organizations should immediately implement patch management procedures to upgrade to versions beyond 3.1.0 where this vulnerability has been addressed. Additionally, administrators should consider implementing additional security measures such as input validation rules and output escaping mechanisms within their WordPress environments, while monitoring for suspicious user activities that might indicate exploitation attempts.
Mitigation strategies should include immediate deployment of the patched plugin version, implementation of web application firewalls capable of detecting XSS patterns in shortcode parameters, and regular security audits of all active plugins. Network-level protections such as content security policies can provide additional defense-in-depth measures against exploitation attempts. Administrators should also conduct user access reviews to ensure that contributor privileges are appropriately restricted and monitored for unusual activities that might indicate compromise of these accounts.
The vulnerability demonstrates the critical importance of proper input sanitization and output escaping in web applications, particularly within CMS platforms where plugins extend functionality while potentially introducing security risks. This case highlights how seemingly minor implementation flaws in third-party components can create significant security implications when combined with appropriate user privileges, emphasizing the need for comprehensive security testing and continuous monitoring of WordPress environments.