CVE-2026-4011: 
WordPress vulnerability analysis and mitigation

CVE-2026-4011 is a Stored Cross-Site Scripting (XSS) vulnerability in the Power Charts Lite plugin for WordPress, affecting all versions up to and including 0.1.0. The flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the id parameter of the [pc] shortcode. It was published to the NVD on April 15, 2026, and added to the GitHub Advisory Database on April 22, 2026. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient input sanitization and output escaping in the pc_shortcode() function. At line 62 of power-charts-shortcodes.php, the id attribute from user-supplied shortcode input is directly concatenated into an HTML <div> element's class attribute without any sanitization or escaping. The resulting HTML is then processed through PHP's html_entity_decode(), which actively reverses any incidental HTML encoding and further undermines output safety, allowing injected scripts to survive rendering (GitHub Advisory, WordPress Trac).

Successful exploitation allows an authenticated attacker (Contributor role or above) to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and defacement of website content. The CVSS scope is marked as Changed, indicating the impact extends beyond the vulnerable component to affect other users' browser sessions (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.032–0.042%, placing it in the 13th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on a site running Power Charts Lite ≤ 0.1.0.
2. Create or Edit a Post: Navigate to the WordPress post editor and create or edit a post/page where shortcodes are rendered.
3. Inject Malicious Payload: Insert the [pc] shortcode with a crafted id parameter containing an XSS payload, for example: [pc id="malicious\" class=\"x onmouseover=alert(document.cookie)"] or a payload that breaks out of the class attribute context to inject a <script> tag.
4. Publish the Content: Submit or publish the post. The unsanitized id value is concatenated directly into the HTML output and then processed by html_entity_decode(), preserving the injected script.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected JavaScript executes in their browser, enabling session token theft, credential harvesting, or further malicious actions (GitHub Advisory, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing [pc shortcode with unusual or encoded characters in the id parameter.
• Database: WordPress wp_posts table entries containing [pc shortcode with JavaScript payloads (e.g., <script>, onerror=, onmouseover=, javascript:) in the id attribute value.
• File System: Unexpected modifications to post content in database exports or backup files containing injected script tags within [pc] shortcode attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages containing the [pc] shortcode.
• Browser/Client: Unexpected JavaScript execution or redirects when visiting WordPress pages that include the Power Charts Lite [pc] shortcode (GitHub Advisory).

As of the advisory publication date, no patched version of Power Charts Lite has been released (the GitHub Advisory Database lists patched versions as "Unknown"). Site administrators should immediately restrict Contributor-level and above permissions to fully trusted users only, or disable the Power Charts Lite plugin until a patched version is available. Implementing a Web Application Firewall (WAF) with rules to detect and block injection attempts in [pc] shortcode parameters is recommended as an interim control. Monitor WordPress installations for suspicious shortcode usage and audit existing posts for injected payloads (GitHub Advisory, Wordfence).

Wordfence identified and reported this vulnerability and included it in their weekly WordPress vulnerability report for April 13–19, 2026. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been observed (Wordfence Blog).