CVE-2026-4730

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'chartid' shortcode attribute in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-473008.8Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-473018.8Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-473027.5Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-473038.8Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-473049.8Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-473057.8Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.CVE-2026-473066.1Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: CVE-2026-473077.5NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssemb CVE-2026-473087.5NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701 CVE-2026-473097.5Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot CVE-2026-47318.5Integer Overflow or Wraparound vulnerability in artraweditor ART (‎rtengine‎ modules). This vulnerability is associated with program files d CVE-2026-473109.8Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da8