What is the CVSS score of CVE-2026-15645?

CVE-2026-15645 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Powerkit WordPress Plugin CVE-2026-15645

EUVD-2026-51747 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-01 Wordfence

GHSA-cvwj-pchh-67x5

WordPress XSS Wordpress Plugin Powerkit Supercharge Your Wordpress Site Codesupplyco

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires victim page visit (UI:R); contributor auth required (PR:L); scope changes to victim browser (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 09:00 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Powerkit - Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Powerkit - Supercharge Your WordPress Site plugin (versions up to and including 3.1.0) enables authenticated contributors to inject persistent malicious scripts via the 'nav' shortcode attribute that execute in any visitor's browser upon page load. Reported by Wordfence, the flaw originates in the tabs.php template and the public class handler where shortcode input is passed to output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed vector (S:C) indicates cross-user impact with a 6.4 medium-high base score.

Technical ContextAI

The vulnerability resides in the Powerkit plugin's basic-elements module, specifically in modules/basic-elements/templates/tabs.php (lines 133 and 135) and modules/basic-elements/public/class-powerkit-basic-elements-public.php (line 113), as confirmed by WordPress Plugin Trac references for both the 3.0.9 and 3.1.0 tagged releases. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS pattern where a shortcode attribute value - in this case the 'nav' parameter - is accepted from an authenticated WordPress user and rendered into the HTML output of a page without adequate escaping via functions such as esc_attr() or esc_html(). The CPE identifier cpe:2.3:a:codesupplyco:powerkit_-_supercharge_your_wordpress_site:*:*:*:*:*:*:*:* confirms the affected vendor and product. WordPress shortcode-based XSS is a well-understood attack class in the WordPress ecosystem, typically exploited when contributor-level users have access to page or post editing.

RemediationAI

Upstream fix is available per WordPress Plugin Repository changeset 3629599 at https://plugins.trac.wordpress.org/changeset/3629599/powerkit; however, the exact patched release version number is not independently confirmed from available data - verify the current plugin version in the WordPress Plugin Directory and upgrade to any version newer than 3.1.0 once confirmed patched. Site administrators should update the plugin immediately via the WordPress dashboard or WP-CLI. As a compensating control while awaiting confirmation of the patched release, restrict contributor-level role assignment to fully trusted users only, since the vulnerability requires at minimum contributor access to exploit - removing untrusted contributors eliminates the primary attack vector. Alternatively, a WAF rule blocking unescaped script tags and event handlers in shortcode parameters (e.g., via Wordfence's built-in firewall rules) can reduce risk with minimal functional impact. The full Wordfence advisory is at https://www.wordfence.com/threat-intel/vulnerabilities/id/5b33aa60-ac20-42c3-a3ab-b29ddfe2284a?source=cve.