The Power Charts Lite WordPress plugin accepts an "id" attribute within the [pc] shortcode and places the raw value directly into an HTML div class attribute. Because the value is concatenated without any escaping or validation, a stored cross‑site scripting vulnerability is created. When the page is rendered, the embedded JavaScript runs automatically in the context of any user who views the page, enabling cookie theft, session hijacking, defacement, or loading of additional malicious payloads.

This flaw exists in all released versions of dgwyer Power Charts – Responsive Beautiful Charts & Graphs up to and including version 0.1.0. Any WordPress site that has installed the plugin and has a user with the Contributor role or higher can create or edit the vulnerable shortcode and consequently implant the malicious script.

The CVSS score of 6.4 indicates moderate severity, but the attack requires an authenticated Contributor or higher, which restricts the attacker’s ability to place the payload. Because EPSS data is not available, the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. When exploited, the script executes for every user who views the affected page, so the potential impact on confidentiality, integrity, and availability remains high for any site that publicly displays content containing the [pc] shortcode.