Improper neutralization of user input during page generation enables a stored XSS flaw in the Google Org Chart WordPress plugin. A malicious actor can inject arbitrary scripts that execute when the page is rendered, potentially compromising the session, harvesting credentials, or defacing the site. The weakness is a classic input validation failure classified as CWE‑79.

The Google Org Chart plugin developed by Aleksandar Arsovski is affected for all releases up to and including version 1.0.1. Any WordPress site that has installed any of these versions inherits the vulnerability.

The CVSS base score of 6.5 indicates moderate to high impact. The EPSS score of less than 1 % denotes a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can inject payloads through the plugin’s input fields, which are persisted and later served to visitors, making the attack remote yet dependent on the site’s configuration and user roles.