CVE-2026-15644

Name of the Vulnerable Software and Affected Versions Powerkit – Supercharge your WordPress Site versions prior to 3.1.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the style shortcode attribute, which execute when a user visits the affected page.

Recommendations Update Powerkit – Supercharge your WordPress Site to a version newer than 3.1.0.