This stored XSS in Powerkit's nav shortcode attribute (CVSS 6.4) warrants more attention than its EPSS score of 0.00206 suggests—not because probability metrics are wrong, but because they model the wrong threat actor for this specific vulnerability.
The contributor-level access requirement is the framing that should dominate your risk assessment. Contributor accounts in WordPress are not rare—they're the standard role for multi-author blogs, editorial teams, and membership sites running Powerkit. The critical question isn't whether attackers can reach this access level (they can, through credential reuse, insider threats, or simply signing up), but what they can achieve once there. The nav shortcode attribute isn't a niche parameter—it controls navigation elements that typically render on every page of a site (headers, footers, breadcrumbs). Unlike XSS in a single post body, exploitation here means persistent JavaScript execution across the entire visitor session, universally, without requiring the attacker to predict which specific content a victim will view.
The 2026 CVE date is analytically significant. If this was coordinated disclosure with advance visibility, your actual threat model shifts from opportunistic scanning to targeted actors who had weeks or months to develop exploits before public disclosure. But more importantly, the WordPress plugin ecosystem has well-documented patch debt—sites routinely run outdated versions for 18+ months because updates break functionality. The EPSS model's assumption that patches translate to remediation doesn't hold here. A Powerkit installation that hasn't been updated since 2023 is likely still vulnerable regardless of what the current version number says.
What should you do? First, audit your Powerkit version—if you're below the patched release, upgrade immediately and treat any contributor accounts created before the patch as potentially compromised. Second, review contributor accounts for anomalous behavior or credential reuse patterns; the attack chain from one compromised Powerkit installation to another via reused credentials is a real compounding risk across the WordPress ecosystem. Third, consider whether navigation shortcode rendering truly needs to execute on every page; if you can restrict it to authenticated admin contexts, you reduce the universal execution surface this vulnerability creates.