CVE-2026-4011

Name of the Vulnerable Software and Affected Versions Power Charts Lite versions prior to 0.1.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the id parameter within the [pc] shortcode. In the pc shortcode() function, the id attribute is extracted from user-supplied attributes and concatenated directly into an HTML div element's class attribute. The resulting HTML is processed through html entity decode(), which further removes safety protections. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update Power Charts Lite to a version newer than 0.1.0. As a temporary mitigation, restrict users with Contributor-level access from editing pages containing the [pc] shortcode.