CVE-2026-15644 Overview
CVE-2026-15644 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Powerkit – Supercharge your WordPress Site plugin for WordPress. The flaw exists in all versions up to and including 3.1.0, and stems from insufficient input sanitization and output escaping of the style attribute in a plugin shortcode. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The payload executes whenever a visitor or administrator loads the affected page, extending the impact scope beyond the attacker's own privileges [CWE-79].
Critical Impact
A contributor account is sufficient to plant persistent JavaScript that runs in the browser context of any user, including higher-privileged administrators, enabling session theft, account takeover, and site defacement.
Affected Products
- Powerkit – Supercharge your WordPress Site plugin (all versions ≤ 3.1.0)
- WordPress sites running the vulnerable Powerkit module basic-elements
- Sites that permit contributor-level or higher account registrations
Discovery Timeline
- 2026-08-01 - CVE-2026-15644 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-15644
Vulnerability Analysis
The vulnerability resides in the Powerkit basic-elements module, specifically in the shortcode handling logic within class-powerkit-basic-elements-public.php and the separators.php template. The plugin exposes a shortcode that accepts a style attribute controlling the rendered separator element. When the shortcode is processed, the style value is interpolated into the generated HTML without sufficient sanitization or output escaping. An authenticated contributor can craft a post or page containing the shortcode with a malicious style attribute that breaks out of the intended HTML attribute context and injects executable script content. Because the payload is stored in post content, every subsequent view of the page triggers script execution in the visitor's browser under the site origin.
Root Cause
The root cause is missing or incomplete application of WordPress escaping functions such as esc_attr() on shortcode attribute values before they are echoed into template output. Shortcode attributes are attacker-controlled input and must be treated as untrusted, but the affected template concatenated the style value directly into rendered HTML.
Attack Vector
An attacker first obtains an account with contributor privileges or higher, which many WordPress sites grant through open registration or guest-author workflows. The attacker then creates a draft post containing the Powerkit separator shortcode with a weaponized style argument carrying HTML-breakout characters and JavaScript. Once the post is previewed, published, or reviewed by an editor, the script executes in the reviewer's browser, enabling cookie theft, administrative action forgery via authenticated fetch requests, or delivery of secondary payloads. See the Wordfence Vulnerability Analysis for a detailed writeup of the shortcode handler and the WordPress PowerKit Changeset for the corresponding fix.
Detection Methods for CVE-2026-15644
Indicators of Compromise
- Posts, pages, or revisions containing the Powerkit separator shortcode with style attribute values that include characters such as ", <, >, onerror=, onload=, or javascript:.
- New or dormant contributor-level accounts creating draft content shortly before administrative sessions are hijacked.
- Outbound browser requests from wp-admin sessions to unfamiliar external domains that correlate with page views of Powerkit-rendered content.
Detection Strategies
- Query the wp_posts table for post content matching the Powerkit shortcode pattern combined with attribute payloads containing <script, on\w+=, or URL-encoded angle brackets.
- Deploy a Web Application Firewall (WAF) rule that inspects requests to post.php and post-new.php for shortcode payloads containing HTML-breakout characters in the style argument.
- Enable a strict Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution on pages that embed Powerkit shortcodes.
Monitoring Recommendations
- Alert on privilege changes and on any contributor account whose posts are edited or approved by an administrator within a short time window.
- Monitor WordPress audit logs for shortcode edits in published posts and for creation of new posts by low-privileged users.
- Track browser telemetry for administrators, watching for anomalous DOM modifications or fetch calls to wp-json/wp/v2/users originating from post-preview or post-view pages.
How to Mitigate CVE-2026-15644
Immediate Actions Required
- Update the Powerkit plugin to a version later than 3.1.0 that includes the fix from changeset 3629599.
- Audit all existing posts and pages for the Powerkit separator shortcode and inspect the style attribute for injected script content.
- Review contributor and author accounts, disable unused accounts, and reset credentials for any account showing suspicious authoring activity.
Patch Information
The vendor addressed the vulnerability in the Powerkit plugin repository via changeset 3629599. The fix adds proper escaping to the shortcode attribute handling in class-powerkit-basic-elements-public.php and the separators.php template. Administrators should apply the update through the WordPress plugin manager or by pulling the latest release from the plugin repository. See the WordPress PowerKit Template File for the fixed template location.
Workarounds
- Restrict post creation privileges by removing contributor-level accounts that do not require authoring rights, and require editorial review of all draft content.
- Deploy a WAF rule that blocks HTTP requests containing the Powerkit shortcode combined with HTML-breakout characters in the style attribute.
- Temporarily deactivate the Powerkit basic-elements module or the entire plugin until the patched version is installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
