The vulnerability resides in the Powerkit plugin’s handling of the 'nav' shortcode attribute. Insufficient sanitization and escaping allow an authenticated contributor or higher user to store arbitrary JavaScript that executes on every page where the shortcode appears. Attackers can hijack user sessions, deface content, or exfiltrate sensitive information by injecting malicious code that runs in the context of other site users.

WordPress sites running Powerkit version 3.1.0 or earlier on the CodesupplyCo suite are vulnerable. The plugin remains in use in many environments, so any site with the affected plugin—and an attacker who has gained contributor or higher privileges—could exploit the flaw.

The CVSS score of 6.4 indicates moderate severity, while the EPSS of less than 1% suggests low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access and depends on the presence of the affected shortcode, it is not trivially exploitable by unauthenticated users but remains a credible threat for sites with broad contributor permissions. The described attack path involves creating or editing a page with the vulnerable shortcode and embedding malicious scripts in the 'nav' attribute. Once published, any visitor to the page will execute the injected code.