Stored Cross-Site Scripting in Organization Chart Plugin for WordPress
CVE-2024-7355

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Organization Chart
Vendor
CVE Published:
7 August 2024

What is CVE-2024-7355?

The Organization Chart plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping in the 'title_input' and 'node_description' parameters. Authenticated attackers with Subscriber-level access and higher can exploit this vulnerability to inject arbitrary scripts into web pages. This malicious code will execute whenever a user visits an affected page, leading to potential data breaches or session hijacking. The default configuration restricts exploitation primarily to administrators, but the vulnerability can be leveraged by subscribers when they have access to chart creation and management functionalities.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/organization-c...
https://wordpress.org/plugins/organization-chart/#developers

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.