CVE-2026-1939 is a stored cross-site scripting vulnerability in the Percent to Infograph WordPress plugin by cutesalah. The issue arises from improper neutralization of user-supplied input in the percent_to_graph shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary web scripts. These scripts are stored and executed when other users access the injected pages. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with contributor-level access can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions or data exposure when other users view the infected pages. The confidentiality and integrity of user data may be compromised, but availability is not affected. There are no known active exploits in the wild currently.

No official patch or remediation is currently available from the vendor. Users should restrict contributor-level access until a fix is released. Monitor vendor advisories for updates. Applying strict input validation or disabling the vulnerable shortcode may reduce risk temporarily. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.