CVE-2026-15645: Powerkit WordPress Plugin XSS Vulnerability

CVE-2026-15645 Overview

CVE-2026-15645 is a Stored Cross-Site Scripting (XSS) vulnerability in the Powerkit – Supercharge your WordPress Site plugin for WordPress. The flaw affects all versions up to and including 3.1.0. It stems from insufficient input sanitization and output escaping on the nav attribute of a plugin-provided shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any user who views an affected page. The vulnerability is tracked under CWE-79 and has been analyzed by Wordfence.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against administrators and site visitors, enabling session theft, forced actions, and account takeover.

Affected Products

Powerkit – Supercharge your WordPress Site plugin, all versions through 3.1.0
WordPress sites allowing contributor-level or higher registration
Sites embedding the vulnerable nav shortcode attribute in the tabs module

Discovery Timeline

2026-08-01 - CVE-2026-15645 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15645

Vulnerability Analysis

The vulnerability lives in the plugin's basic-elements module, specifically the tabs shortcode handler. The plugin accepts a nav attribute value from user-controlled shortcode input and renders it into the resulting HTML page. The relevant source paths are modules/basic-elements/public/class-powerkit-basic-elements-public.php and modules/basic-elements/templates/tabs.php. Because the plugin does not sanitize the incoming attribute or escape it on output, attacker-supplied markup and script content passes through unchanged. Contributors, who can author draft posts and use shortcodes, can weaponize this path to plant persistent payloads. Any administrator, editor, or visitor loading the affected page becomes a target. Successful exploitation permits session cookie exfiltration, forced administrative actions via CSRF-style JavaScript, and pivoting toward account takeover.

Root Cause

The root cause is missing input sanitization combined with missing output escaping on a shortcode attribute. WordPress provides helper functions such as sanitize_text_field() and esc_attr() for exactly this use case. The vulnerable code path in the tabs template renders the nav value directly into HTML attribute or element context. The vendor's fix in changeset 3629599 adds proper escaping to close this gap.

Attack Vector

An attacker registers or already holds a contributor account. The attacker creates a post containing the tabs shortcode with a crafted nav attribute carrying a JavaScript payload. When an authenticated reviewer or site visitor loads the rendered page, the browser executes the script in the site's origin. Because the CVSS scope is changed, execution impacts users beyond the compromised component. See the Powerkit tabs template source for the vulnerable rendering location.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose based on the vendor source references above.

Detection Methods for CVE-2026-15645

Indicators of Compromise

Post or page content containing the Powerkit tabs shortcode with nav attribute values that include HTML tags, on*= event handlers, javascript: URIs, or <script> fragments
Unexpected outbound requests from browser sessions loading pages authored by contributor accounts
New or modified administrator accounts, plugin installations, or theme file edits shortly after contributor content publication
WordPress audit log entries showing contributor-authored posts submitted for review that contain shortcode attributes with encoded script payloads

Detection Strategies

Query the wp_posts table for post content matching the Powerkit tabs shortcode combined with suspicious attribute characters such as <, >, ", or javascript:
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies submitted to /wp-admin/post.php for shortcode attributes containing script tokens
Enable Content Security Policy (CSP) reporting to surface inline script executions originating from post content
Review contributor and author role assignments and correlate with recent post revisions

Monitoring Recommendations

Log and alert on administrator sessions that load pages authored by contributor-level users for the first time
Monitor plugin file integrity for the modules/basic-elements/ directory to confirm patch application
Track outbound HTTP requests from authenticated admin browser sessions to non-approved domains

How to Mitigate CVE-2026-15645

Immediate Actions Required

Update the Powerkit plugin to a version above 3.1.0 that includes changeset 3629599
Audit existing posts and pages for the tabs shortcode and inspect nav attribute values for script content before publishing
Restrict contributor role assignments and require editorial review of all draft submissions containing shortcodes
Rotate administrator session cookies and reset passwords for accounts that reviewed contributor drafts on affected pages

Patch Information

The vendor addressed the vulnerability in a release following 3.1.0. Refer to the Powerkit changeset 3629599 for the source-level fix and the Wordfence advisory for release notes.

Workarounds

Disable the Powerkit plugin until the patched release can be deployed
Remove or restrict the tabs module within the plugin's basic-elements configuration if disabling the entire plugin is not viable
Downgrade all contributor accounts to subscriber until patched, preventing use of shortcodes in draft content
Deploy a WAF virtual patch that blocks shortcode attributes containing <script, on[a-z]+=, or javascript: tokens

bash

# WAF pseudo-rule blocking XSS payloads in Powerkit tabs shortcode submissions
SecRule ARGS:content "@rx \[powerkit_tabs[^\]]*nav\s*=\s*[\"'][^\"']*(<script|onerror=|onload=|javascript:)" \
  "id:1015645,phase:2,deny,status:403,log,msg:'CVE-2026-15645 Powerkit nav XSS blocked'"