CVE-2024-47347

The Chartify plugin (WordPress plugin chart-builder) is vulnerable to a reflected Cross-Site Scripting (XSS) attack due to improper neutralization of user input during web page generation. Versions up to and including 2.7.6 are affected, as identified by Patchstack [1].

An attacker can craft a malicious URL that, when clicked by a privileged user (such as an administrator), triggers the execution of arbitrary JavaScript in the context of the victim's browser. User interaction is required, but no authentication is needed from the attacker's side to deliver the link [1].

Successful exploitation allows the attacker to inject malicious scripts, redirect visitors to external sites, display advertisements, or perform other actions that compromise the integrity of the affected WordPress site. This vulnerability is considered moderately dangerous and is expected to be used in mass-exploit campaigns [1].

Mitigation is straightforward: update the Chartify plugin to version 2.7.7 or later, which contains a fix for this issue. Administrators unable to update immediately can apply a mitigation rule provided by Patchstack or consult their hosting provider for assistance [1].