CVE-2026-4011: Power Charts Lite WordPress XSS Flaw

CVE-2026-4011 Overview

The Power Charts Lite plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the [pc] shortcode functionality. The vulnerability exists in all versions up to and including 0.1.0 due to insufficient input sanitization and output escaping on the id shortcode attribute. This flaw allows authenticated attackers with Contributor-level access or higher to inject malicious JavaScript code that executes when any user views an affected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts into WordPress pages, potentially leading to session hijacking, defacement, phishing attacks, or malware distribution to site visitors.

Affected Products

• Power Charts Lite for WordPress version 0.1.0 and earlier
• WordPress sites using wpgo-power-charts-lite plugin

Discovery Timeline

• 2026-04-15 - CVE-2026-4011 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-4011

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from improper handling of user-supplied input in the Power Charts Lite plugin's shortcode processing functionality. The vulnerable code path begins in the pc_shortcode() function where the id attribute is extracted from shortcode parameters and directly concatenated into an HTML div element's class attribute at line 62 of the power-charts-shortcodes.php file without any escaping or sanitization.

Compounding the issue, the resulting HTML markup is then passed through the html_entity_decode() function before being returned to the browser. This additional processing step actively undermines any potential HTML entity encoding that might have been present, effectively reversing protective measures and ensuring that injected script content is rendered as executable code.

The attack requires Contributor-level WordPress permissions or higher, limiting the attack surface to authenticated users who can create or edit posts containing shortcodes. However, once a malicious payload is injected, it persists in the database and executes for every visitor who views the affected page, including administrators.

Root Cause

The root cause is the direct concatenation of user-controlled shortcode attribute values into HTML output without proper sanitization or escaping. WordPress provides built-in functions such as esc_attr() and wp_kses() specifically designed to prevent XSS attacks in shortcode attributes, but these protections were not implemented. The use of html_entity_decode() on the output further exacerbates the vulnerability by actively decoding any HTML entities that might otherwise render harmlessly.

Attack Vector

An authenticated attacker with Contributor-level access or above can exploit this vulnerability by creating or editing a post containing the [pc] shortcode with a maliciously crafted id parameter. Since the id attribute is inserted directly into a class attribute in the HTML output, an attacker can break out of the attribute context and inject arbitrary JavaScript. The malicious script is stored in the WordPress database and executes whenever any user, including administrators, visits the page containing the injected shortcode. This could be leveraged for session theft, privilege escalation, or delivering secondary payloads to site visitors.

The vulnerability mechanism operates through direct attribute injection in the shortcode handler. An attacker would craft a shortcode with a malicious id parameter designed to escape the class attribute context and inject JavaScript event handlers or script elements. The pc_shortcode() function extracts this attribute value and concatenates it directly into the HTML div element's class attribute without sanitization. The subsequent html_entity_decode() call ensures any encoded characters are decoded before output, guaranteeing script execution. For detailed technical analysis, refer to the vulnerable code at line 62 and the Wordfence vulnerability analysis.

Detection Methods for CVE-2026-4011

Indicators of Compromise

• Unusual or obfuscated content in the id attribute of [pc] shortcodes within WordPress posts
• Posts containing [pc] shortcodes with JavaScript keywords such as onerror, onload, onclick, or <script> tags
• Unexpected administrative actions or session activity that may indicate compromised admin sessions
• Browser console errors or unexpected script execution when viewing posts with Power Charts content

Detection Strategies

• Review WordPress post content in the database for [pc] shortcodes containing suspicious characters such as quotes, angle brackets, or JavaScript event handlers
• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in shortcode parameters
• Enable Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Deploy endpoint detection solutions to monitor for anomalous browser behavior on WordPress admin pages

Monitoring Recommendations

• Configure WordPress activity logging to track post creation and editing by Contributor-level users
• Monitor server access logs for unusual patterns of access to pages containing Power Charts shortcodes
• Implement real-time alerting for CSP violation reports that may indicate XSS exploitation attempts
• Audit user accounts with Contributor or higher privileges for unauthorized access

How to Mitigate CVE-2026-4011

Immediate Actions Required

• Deactivate the Power Charts Lite plugin until a patched version is available
• Audit existing WordPress posts for any [pc] shortcodes containing suspicious or unexpected content in the id parameter
• Review user accounts with Contributor-level access or above and temporarily restrict permissions if necessary
• Implement a Web Application Firewall with XSS protection rules as an additional defense layer

Patch Information

At the time of publication, no official patch has been released for this vulnerability. The vulnerable code exists in Power Charts Lite version 0.1.0 and all prior versions. Website administrators should monitor the WordPress plugin repository for updates that implement proper input sanitization using WordPress escaping functions such as esc_attr() on the id shortcode attribute.

Workarounds

• Disable the Power Charts Lite plugin entirely until an official security update is available
• Restrict Contributor-level access and require editorial review for all posts containing shortcodes
• Implement strict Content Security Policy headers to mitigate the impact of any injected scripts
• Use a security plugin or WAF to filter and sanitize shortcode attributes before processing

# WordPress configuration example - restrict shortcode usage
# Add to wp-config.php to disable shortcodes for contributors
# Note: This is a general hardening measure, not a direct fix
define('DISALLOW_UNFILTERED_HTML', true);

# Implement CSP header in .htaccess
# Header set Content-Security-Policy "default-src 'self'; script-src 'self';"