WordPress Plugin Vulnerabilities

amCharts: Charts and Maps < 1.4.1 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
amcharts-charts-and-maps
Fixed in 1.4.1

References

CVE
CVE-2022-36405

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Ngo Van Thien
Verified
No
WPVDB ID
7aaabffe-9255-4fcb-a1e7-3af28d50dfee

Timeline

Publicly Published
2022-08-09 (about 3 years ago)
Added
2022-08-24 (about 3 years ago)
Last Updated
2022-08-24 (about 3 years ago)

Other

Published
Title
Published
2021-03-24
Title
MapifyLite & MapifyPro < 4.0.0 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2023-01-11
Title
WC Vendors Marketplace < 2.4.5 - Contributor+ Stored XSS
Published
2025-09-03
Title
Tooltipy < 5.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-03-30
Title
Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)
Published
2025-01-06
Title
Slider Pro Lite <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting