CVE-2026-15644 is a stored cross-site scripting vulnerability in the Powerkit – Supercharge your WordPress Site plugin for WordPress. The flaw exists in the handling of the 'style' shortcode attribute, where input is not properly sanitized or escaped before being included in web pages. This allows authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of other users viewing the injected content. The vulnerability affects all versions up to and including 3.1.0. The CVSS v3.1 base score is 6.4, indicating a medium severity. There is no vendor advisory or patch information currently available.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the privileges of the victim user. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable shortcode if possible.