The vulnerability is an improper neutralization of input during web page generation in the Ays Pro Chartify plugin, which permits stored cross‑site scripting. Malicious input can be stored in chart data and later executed in the browser when the chart is displayed, potentially allowing the injection of JavaScript that steals user credentials or performs unauthorized actions within the scope of the victim’s session.

The affected product is the WordPress Chartify plugin from Ays Pro, versions n/a through 3.1.7. Any WordPress installation using this plugin with a vulnerable version is at risk.

The CVSS base score is 5.9, indicating moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to inject data through the plugin’s chart creation or editing interface, typically an administrator or editor role. Once injected, the script executes in the context of any user who views the chart, compromising confidentiality and integrity of the user’s session data.