Stored Cross-Site Scripting in Organization Chart Plugin for WordPress

CVE-2024-7355

Summary

The Organization Chart plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping in the 'title_input' and 'node_description' parameters. Authenticated attackers with Subscriber-level access and higher can exploit this vulnerability to inject arbitrary scripts into web pages. This malicious code will execute whenever a user visits an affected page, leading to potential data breaches or session hijacking. The default configuration restricts exploitation primarily to administrators, but the vulnerability can be leveraged by subscribers when they have access to chart creation and management functionalities.

References