WordPress Plugin Vulnerabilities

Chart Builder < 1.9.7 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
chart-builder
Fixed in 1.9.7

References

URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/18cbf346-91a3-4856-930e-7753eb1470d9

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Verified
No
WPVDB ID
6d77c1f3-104a-458d-ada1-51c133ed4a4d

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2024-01-29 (about 2 years ago)
Last Updated
2024-01-29 (about 2 years ago)

Other

Published
Title
Published
2024-12-03
Title
SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
Published
2026-02-04
Title
The Events Calendar Shortcode & Block < 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-10
Title
Affiliate Link Tracker <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2026-02-13
Title
QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2023-03-28
Title
MS-Reviews <= 1.5 - Subscriber+ Stored XSS