{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4011", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-11T19:05:31.880Z", "datePublished": "2026-04-15T08:28:17.209Z", "dateUpdated": "2026-04-15T16:13:09.653Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-15T08:28:17.209Z"}, "affected": [{"vendor": "dgwyer", "product": "Power Charts \u2013 Responsive Beautiful Charts & Graphs", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [pc] shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the pc_shortcode() function, the 'id' attribute is extracted from user-supplied shortcode attributes and directly concatenated into an HTML div element's class attribute without any escaping or sanitization at line 62. The resulting HTML is then passed through html_entity_decode() before being returned, further undermining any potential safety. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Power Charts <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea41d391-ba8d-43d9-8eda-69ac28c49328?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/tags/0.1.0/classes/power-charts-shortcodes.php#L40"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/trunk/classes/power-charts-shortcodes.php#L62"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/tags/0.1.0/classes/power-charts-shortcodes.php#L62"}, {"url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/trunk/classes/power-charts-shortcodes.php#L40"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2026-04-14T19:45:38.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T13:32:13.516310Z", "id": "CVE-2026-4011", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T16:13:09.653Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [pc] shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the pc_shortcode() function, the 'id' attribute is extracted from user-supplied shortcode attributes and directly concatenated into an HTML div element's class attribute without any escaping or sanitization at line 62. The resulting HTML is then passed through html_entity_decode() before being returned, further undermining any potential safety. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-4011", "lastModified": "2026-04-15T09:16:32.883", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-15T09:16:32.883", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/tags/0.1.0/classes/power-charts-shortcodes.php#L40"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/tags/0.1.0/classes/power-charts-shortcodes.php#L62"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/trunk/classes/power-charts-shortcodes.php#L40"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/trunk/classes/power-charts-shortcodes.php#L62"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea41d391-ba8d-43d9-8eda-69ac28c49328?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.1.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Power Charts \u2013 Responsive Beautiful Charts & Graphs", "source": "cna", "vendor": "dgwyer"}, "product": "power_charts_\u2013_responsive_beautiful_charts_&_graphs", "vendor": "dgwyer"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T11:28:46.914377+00:00", "value": {"mitigation_remediation": ["Upgrade Power Charts Lite to a version newer than 0.1.0, where the id attribute is properly sanitized and escaped.", "If an upgrade cannot be performed, deactivate the Power Charts Lite plugin or remove the [pc] shortcode from the site\u2019s content, and restrict contributors from using shortcodes that are not vetted.", "Alternatively, manually edit power-charts-shortcodes.php or apply a custom filter to sanitize or escape the id attribute before it is injected into the HTML class attribute, ensuring that no executable script can be stored."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting that allows authenticated users to inject scripts executed in the browsers of any visitor to a page containing the vulnerable shortcode"}, "threat_synthesis": {"affected_systems": "This flaw exists in all released versions of dgwyer Power Charts \u2013 Responsive Beautiful Charts & Graphs up to and including version 0.1.0. Any WordPress site that has installed the plugin and has a user with the Contributor role or higher can create or edit the vulnerable shortcode and consequently implant the malicious script.", "description_and_impact": "The Power Charts Lite WordPress plugin accepts an \"id\" attribute within the [pc] shortcode and places the raw value directly into an HTML div class attribute. Because the value is concatenated without any escaping or validation, a stored cross\u2011site scripting vulnerability is created. When the page is rendered, the embedded JavaScript runs automatically in the context of any user who views the page, enabling cookie theft, session hijacking, defacement, or loading of additional malicious payloads.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, but the attack requires an authenticated Contributor or higher, which restricts the attacker\u2019s ability to place the payload. Because EPSS data is not available, the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. When exploited, the script executes for every user who views the affected page, so the potential impact on confidentiality, integrity, and availability remains high for any site that publicly displays content containing the [pc] shortcode."}}}}, "created": "2026-04-15T13:49:14.861036+00:00", "updated": "2026-04-15T14:53:14.927147+00:00", "vendors": ["dgwyer", "dgwyer$PRODUCT$power_charts_\u2013_responsive_beautiful_charts_&_graphs", "wordpress", "wordpress$PRODUCT$wordpress"]}