CVE-2026-15649 Overview
CVE-2026-15649 is a Stored Cross-Site Scripting (XSS) vulnerability in the Powerkit – Supercharge your WordPress Site plugin for WordPress. The flaw affects all versions up to and including 3.1.0. The root cause is insufficient input sanitization and output escaping on shortcode attributes handled by the plugin's basic-elements module. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any user who views an affected page. The issue is classified under CWE-79.
Critical Impact
Contributor-level attackers can persist arbitrary JavaScript on published pages, enabling session theft, credential harvesting, and administrative action forgery against site visitors and editors.
Affected Products
- Powerkit – Supercharge your WordPress Site plugin for WordPress
- All versions up to and including 3.1.0
- The basic-elements module, specifically the progressbars shortcode template
Discovery Timeline
- 2026-08-01 - CVE-2026-15649 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-15649
Vulnerability Analysis
The vulnerability resides in the Powerkit basic-elements module, which registers shortcodes users can embed inside posts and pages. Shortcode attributes supplied by an author are passed into rendering templates, including modules/basic-elements/templates/progressbars.php, without being properly sanitized on input or escaped on output. When a page containing the malicious shortcode is rendered, the injected payload executes in the visitor's browser session.
Because the payload is stored in the post content, every visitor to the affected page triggers execution. If an administrator views the page, the attacker's script runs with administrator privileges in the DOM, allowing account takeover, plugin installation, or persistent backdoors via authenticated WordPress REST calls.
Root Cause
The plugin registers shortcodes in class-powerkit-basic-elements-public.php and forwards attribute values directly to the template layer. The template outputs those attributes into HTML contexts without applying esc_attr(), esc_html(), or wp_kses() filtering. Combined with the absence of sanitize_text_field() calls on shortcode input, this produces a stored XSS sink [CWE-79].
Attack Vector
An authenticated attacker with contributor privileges creates or edits a post containing the vulnerable Powerkit shortcode. The attacker sets a shortcode attribute value to a crafted string that breaks out of the intended HTML attribute context and injects a <script> tag or event handler. Once the post is submitted for review or published, any user rendering the page executes the payload. No user interaction beyond page load is required, and the attack originates over the network against the WordPress front end.
Detailed vulnerable code paths are available in the WordPress PowerKit Class Code and the WordPress PowerKit Template Code.
Detection Methods for CVE-2026-15649
Indicators of Compromise
- Posts or pages containing Powerkit shortcodes (for example [powerkit_progressbar ...]) with attribute values containing angle brackets, javascript: URIs, or on* event handlers.
- Unexpected <script> tags rendered inside plugin-generated HTML wrappers on the public site.
- Contributor or author accounts publishing content that includes obfuscated or base64-encoded strings inside shortcode attributes.
- Outbound requests from visiting browsers to attacker-controlled domains referenced by injected scripts.
Detection Strategies
- Grep the wp_posts table for Powerkit shortcode tags combined with suspicious characters: SELECT ID, post_author FROM wp_posts WHERE post_content REGEXP 'powerkit_[a-z_]+[^]]*(<|javascript:|onerror=|onload=)'.
- Review the WordPress audit log for content edits by contributor-level accounts that add or modify Powerkit shortcodes.
- Monitor the rendered front-end HTML with a headless scanner and flag inline scripts sourced from post content regions.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script violations originating from post content.
- Alert on new low-privilege user registrations followed by rapid post creation containing shortcodes.
- Forward WordPress and web server access logs to a centralized analytics platform and hunt for anomalous administrator-session activity following contributor edits.
How to Mitigate CVE-2026-15649
Immediate Actions Required
- Update the Powerkit plugin to a version later than 3.1.0 that includes the fix from WordPress PowerKit Changeset 3629599.
- Audit all posts and pages containing Powerkit shortcodes for injected scripts, javascript: URIs, and event-handler attributes.
- Review contributor, author, and editor accounts for unexpected registrations or privilege changes and rotate credentials for suspected accounts.
- Force logout of all active sessions and require password resets if evidence of exploitation is found.
Patch Information
The vendor addressed the issue in the changeset published at WordPress PowerKit Changeset 3629599. Site operators should upgrade beyond version 3.1.0. Additional analysis is available in the Wordfence Vulnerability Report.
Workarounds
- Deactivate and remove the Powerkit plugin until the patched release can be deployed.
- Restrict contributor-level and higher accounts to trusted users only and temporarily disable new user registrations.
- Deploy a Web Application Firewall (WAF) rule that blocks requests containing <script, javascript:, or on*= patterns inside Powerkit shortcode attributes.
- Enforce a strict Content Security Policy that disallows inline scripts on public pages to blunt payload execution.
# Configuration example: locate and remove the vulnerable plugin via WP-CLI
wp plugin status powerkit
wp plugin deactivate powerkit
wp plugin update powerkit --version=latest
# Verify remediation
wp plugin get powerkit --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
