CVE-2026-15645 describes a stored cross-site scripting vulnerability (CWE-79) in the Powerkit – Supercharge your WordPress Site plugin for WordPress. The flaw is due to improper neutralization of input in the 'nav' shortcode attribute, allowing authenticated users with contributor-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages. The vulnerability affects all plugin versions up to and including 3.1.0. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable 'nav' shortcode attribute. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity of affected users. The vulnerability does not impact availability. The medium CVSS score reflects the moderate risk posed by this vulnerability in typical WordPress environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if feasible. Monitor for updates from the vendor or trusted security sources regarding patches or official mitigations.