Security Alert Summary
The Percent to Infograph plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the percent_to_graph shortcode. Insufficient input sanitization and output escaping of user-supplied shortcode attributes allow authenticated users with contributor-level access and above to inject scripts that execute when a page with the injected shortcode is viewed.
CVE Details
- CVE ID: CVE-2026-1939
- Affected component: Percent to Infograph plugin for WordPress
- Affected versions: All versions up to, and including, 1.0
- Published: February 14, 2026 at 7:16:11 AM UTC
- Last modified: February 14, 2026 at 7:16:11 AM UTC
- CVSS v3.1 base score: 6.4 (MEDIUM)
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction:
- Authentication: requires an authenticated user (contributor-level or higher)
- Privileges required: Low (PR:L)
- User Interaction: None (UI:N)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The vulnerability is a stored Cross-Site Scripting issue that exists in the plugin’s handling of the percent_to_graph shortcode. User-supplied attributes passed to this shortcode are not sufficiently sanitized or escaped before being output, which allows an authenticated user with contributor-level permissions or higher to store arbitrary web scripts in pages. Those scripts will execute whenever a visitor (or another authenticated user) loads the affected page.
The problem arises from missing or insufficient input validation and output escaping on shortcode attributes; the CVE description specifies that the lack of proper sanitization and escaping is the root cause. The impact is limited to what an injected script can access or perform in the context of a viewer’s browser (for example, reading DOM-accessible data or performing actions available to that user), and does not, by itself, indicate remote code execution on the server.
How This Could Impact Your Website
Imagine a site with multiple users: a site owner managing settings, an editor publishing content, internal staff contributing posts, and an external contractor or contributor adding content via shortcodes. A contributor could include a crafted percent_to_graph shortcode attribute containing JavaScript. When editors or site visitors load that page, the injected script can run in their browsers.
Practical consequences include exposure of information available to the browser (such as visible user data or email addresses displayed on pages), session token theft in scenarios where session cookies are accessible to client-side scripts, or actions performed in the context of the logged-in user leading to targeted phishing or social engineering attacks. The CVSS impacts indicate confidentiality and integrity are affected at a low level; this typically enables localized data exposure or client-side manipulation rather than full site compromise.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (If no patched version is specified in the CVE entry, monitor the plugin author or official plugin repository for updates.)
- Review and reduce unnecessary user roles, especially contributor-level accounts that allow content submission.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, such as unexpected content changes or script injections.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/percent-to-infograph/tags/1.0/percent_infograph.php#L85
- https://plugins.trac.wordpress.org/browser/percent-to-infograph/trunk/percent_infograph.php#L85
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6e6fcb-1688-424e-b0fa-1c0ace474c2c?source=cve
