The Charts Ninja plugin for WordPress is vulnerable to stored cross‑site scripting through its 'chartid' shortcode attribute. Because input is inadequately sanitized and output unescaped, authenticated users with Contributor or higher privileges can inject arbitrary JavaScript that executes whenever another user views an affected page. This flaw permits defacement, theft of session cookies, or other malicious actions that compromise the confidentiality, integrity, and availability of the site for downstream users.

All installations of the Charts Ninja plugin up to and including version 2.1.0, marketed by Common Ninja under the name "Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website." The vulnerability is present in every version of the plugin released before the 2.1.0 tag.

The flaw carries a CVSS score of 6.4, indicating moderate severity, and it has not been listed in CISA's KEV catalog. Exploitation requires only that the attacker obtain Contributor‑level access and that the injected code be embedded in a page rendered by the site. While the EPSS score is not available, the stored nature of the defect means the impact persists until the offending content is removed or the plugin is upgraded. An attacker could leverage this to insert persistent payloads that affect all users who view the page, potentially leading to widespread compromise within the affected WordPress site.