CVE-2026-4011

The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [pc] shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the pc_shortcode() function, the 'id' attribute is extracted from user-supplied shortcode attributes and directly concatenated into an HTML div element's class attribute without any escaping or sanitization at line 62. The resulting HTML is then passed through html_entity_decode() before being returned, further undermining any potential safety. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/tags/0.1.0/classes/power-charts-shortcodes.php#L40
• https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/tags/0.1.0/classes/power-charts-shortcodes.php#L62
• https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/trunk/classes/power-charts-shortcodes.php#L40
• https://plugins.trac.wordpress.org/browser/wpgo-power-charts-lite/trunk/classes/power-charts-shortcodes.php#L62
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ea41d391-ba8d-43d9-8eda-69ac28c49328?source=cve

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40104XWiki Platform is a generic wiki platform offering runtime s…8.2
• CVE-2026-40105XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2026-40106Wazuh is a free and open source platform used for threat pre…7.8
• CVE-2026-40107SiYuan is a personal knowledge management system. Prior to 3…6.5
• CVE-2026-40108GLPI is a free asset and IT management software package. In …7.1
• CVE-2026-40109Flux notification-controller is the event forwarder and noti…3.1
• CVE-2026-40110Jupyter Server is the backend for Jupyter web applications. …7.3
• CVE-2026-40111PraisonAIAgents is a multi-agent teams system. Prior to 1.5.…8.8
• CVE-2026-40112PraisonAI is a multi-agent teams system. Prior to 4.5.128, t…6.1
• CVE-2026-40113PraisonAI is a multi-agent teams system. Prior to 4.5.128, d…8.1
• CVE-2026-40114PraisonAI is a multi-agent teams system. Prior to 4.5.128, t…10
• CVE-2026-40115PraisonAI is a multi-agent teams system. Prior to 4.5.128, t…7.5