CVE-2026-15649 codesupplyco CVE debrief

Who should care

WordPress administrators and users with contributor-level access, as well as security teams monitoring for potential XSS attacks, should be aware of this vulnerability. They should review their deployments for the Powerkit plugin, assess the potential impact, and plan for remediation. Additionally, they should validate and sanitize all user input, implement output escaping for shortcode attributes, and restrict contributor-level access to sensitive functionality.

Technical summary

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access to inject arbitrary web scripts. The vulnerability could potentially allow attackers to execute malicious scripts in pages that are accessed by other users, potentially leading to unauthorized actions or data breaches.

Defensive priority

Authenticated attackers with contributor-level access can inject web scripts via shortcode attributes, requiring input validation and output escaping.

Recommended defensive actions

• Validate and sanitize all user input
• Implement output escaping for shortcode attributes
• Restrict contributor-level access to sensitive functionality
• Monitor for suspicious activity and injected scripts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but further analysis is needed to determine affected scope and remediation. The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Evidence limits suggest that additional verification may be required to confirm affected deployments and assess potential impact.

Official resources