CVE-2026-15649 is a stored cross-site scripting vulnerability (CWE-79) in the Powerkit – Supercharge your WordPress Site plugin for WordPress. The issue exists in all versions up to and including 3.1.0 due to improper neutralization of input during web page generation, specifically via shortcode attributes. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker with contributor-level or higher access can inject malicious scripts into pages via shortcode attributes, leading to stored cross-site scripting. This can result in the execution of arbitrary scripts in the context of users who visit the compromised pages, potentially exposing user data or enabling further attacks. The vulnerability affects confidentiality and integrity but does not impact availability. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected shortcode attributes. Monitor vendor channels for updates and apply patches promptly once available.