The Wp chart generator plugin for WordPress is vulnerable to stored cross‑site scripting through its wpchart shortcode. All versions up to and including 1.0.4 allow an attacker who is authenticated with contributor or higher privileges to supply attributes that are not properly sanitized or escaped. These attributes can contain arbitrary JavaScript, which will be rendered and executed whenever an end‑user views a page that contains the injected shortcode. The vulnerability does not grant file upload or remote code execution features, but it enables script execution in the context of site visitors.

The affected product is the Wp chart generator plugin developed by emilien. Versions 1.0.4 and earlier are affected, as indicated by the vulnerability range notation. No other versions are listed as vulnerable.

The CVSS score of 6.4 classifies the issue as moderate severity. The EPSS score of < 1 % suggests that exploitation attempts are currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. Because an authenticated account with contributor or higher privileges is required, the risk is confined to sites that have such accounts or where credentials might be compromised. Once a malicious user injects the script, it will execute for any site visitor who views the modified page.