CVE-2026-1939 Overview
CVE-2026-1939 is a Stored Cross-Site Scripting (XSS) vulnerability in the Percent to Infograph plugin for WordPress. The flaw affects all versions up to and including 1.0. The plugin fails to sanitize input and escape output on user-supplied attributes passed to the percent_to_graph shortcode. Authenticated users with contributor-level access or above can inject arbitrary JavaScript that executes in the browser of any visitor who views the affected page. The issue is classified under [CWE-79] for improper neutralization of input during web page generation.
Critical Impact
Authenticated contributors can store malicious JavaScript in WordPress pages, enabling session theft, account takeover, and arbitrary actions executed in the browser of any viewer.
Affected Products
- Percent to Infograph plugin for WordPress, all versions through 1.0
- WordPress sites where contributor-or-higher accounts are provisioned
- Any page or post rendering the percent_to_graph shortcode
Discovery Timeline
- 2026-02-14 - CVE-2026-1939 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-1939
Vulnerability Analysis
The Percent to Infograph plugin exposes a percent_to_graph shortcode that accepts user-supplied attributes. These attribute values are echoed into rendered HTML without sufficient sanitization or output escaping. An authenticated attacker with at least contributor privileges can craft a shortcode invocation containing script payloads. When an editor or administrator previews the content, or when a visitor loads the published page, the injected script executes in their browser context.
The stored nature of the flaw makes it persistent. The payload remains in the database until the post is edited or removed. Because script execution occurs in the origin of the WordPress site, attackers can read authenticated session cookies, issue privileged REST API requests, or modify content as the victim.
Root Cause
The vulnerability originates in percent_infograph.php at the shortcode handler. The handler concatenates attribute values directly into HTML output without applying esc_attr(), esc_html(), or wp_kses() filtering. Reference the affected line in the WordPress Plugin File and the Plugin Trunk File.
Attack Vector
The attack requires network access to the WordPress admin interface and a valid contributor account. The attacker creates or edits a post that contains the percent_to_graph shortcode with malicious attribute values carrying JavaScript. When the post is rendered, the browser parses the injected script and executes it. Because the scope is changed (CVSS scope:changed), the impact extends beyond the vulnerable component into the browser sessions of other users.
No public proof-of-concept exploit is recorded in the NVD references. Technical details are documented in the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-1939
Indicators of Compromise
- Posts or pages containing percent_to_graph shortcode invocations with attribute values that include <script>, onerror=, onload=, or javascript: substrings
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts
- New administrator accounts or modified user roles created shortly after contributor activity
Detection Strategies
- Query the wp_posts table for post_content matching the regular expression percent_to_graph[^\]]*(script|onerror|onload|javascript:) to surface injected payloads
- Review WordPress audit logs for contributor accounts editing or publishing posts that contain the affected shortcode
- Inspect HTTP responses from production pages for <script> tags emitted inside shortcode-generated markup
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) rule set that blocks XSS payloads in POST requests to /wp-admin/post.php and /wp-json/wp/v2/posts
- Alert on creation or privilege elevation of WordPress user accounts following contributor content submissions
- Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on plugin-rendered pages
How to Mitigate CVE-2026-1939
Immediate Actions Required
- Deactivate and remove the Percent to Infograph plugin until a patched release is published by the vendor
- Audit all posts and pages for the percent_to_graph shortcode and remove or sanitize any suspicious attribute values
- Review contributor-level accounts and revoke access for unverified or inactive users
- Rotate session tokens and administrator passwords if injected content is found in published posts
Patch Information
At the time of publication, no fixed version is listed in the NVD record. All versions up to and including 1.0 remain vulnerable. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for a security release.
Workarounds
- Restrict the contributor role from publishing posts that contain unfiltered shortcodes by using a role-management plugin
- Deploy a WAF rule that strips or blocks script tags and event handler attributes from shortcode parameters
- Implement a strict Content Security Policy that disallows inline script execution to limit payload impact
- Disable the percent_to_graph shortcode by calling remove_shortcode('percent_to_graph') in a custom mu-plugin until a patch is available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
