Chart.js for WordPress <= 2023.2 – Editor+ Stored Cross-Site Scripting | CVE 2023-6082 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. Go to "Charts > Settings".
2. For the Font Family, enter the payload: `</script>">//<SCRIPT>alert("XSS");</SCRIPT>.
3. Click on save and visit any page on the site to see the XSS.

Affects Plugins

No known fix

References

CVE

URL

https://lynk.nl/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas & Sergen Koç

Submitter

Asif Nawaz Minhas & Sergen Koç

Submitter website

https://hackpertise.com

Verified

Yes

WPVDB ID

c3d43aac-66c8-4218-b3f0-5256f895eda3

Timeline

Publicly Published

2024-01-19 (about 1 year ago)

Added

2024-01-19 (about 1 year ago)

Last Updated

2024-01-19 (about 1 year ago)

Other

Published

Title

Published

2022-12-29

Title

WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode

Published

2022-07-18

Title

YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site Scripting

Published

2025-03-31

Title

IMPress for IDX Broker < 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-14

Title

Contact Form 7 Redirect & Thank You Page < 1.0.8 - Reflected Cross-Site Scripting

Published

2025-11-19

Title

HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source