CVE-2024-47347 Overview
CVE-2024-47347 is a reflected Cross-Site Scripting (XSS) vulnerability in the Ays Pro Chartify WordPress plugin, also distributed as chart-builder. The flaw affects all versions up to and including 2.7.6. It results from improper neutralization of user-supplied input during web page generation, tracked under [CWE-79].
An unauthenticated attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. Because the scope is changed, code executes in the context of the vulnerable WordPress site, enabling session theft, admin account takeover, or content manipulation.
Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser by tricking users into clicking a crafted link, potentially hijacking WordPress administrator sessions.
Affected Products
- Ays Pro Chartify (chart-builder) WordPress plugin versions up to and including 2.7.6
- WordPress sites with the Chartify plugin installed and active
- All hosting environments running vulnerable versions of the plugin
Discovery Timeline
- 2024-10-06 - CVE-2024-47347 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47347
Vulnerability Analysis
The vulnerability is a reflected XSS flaw in the Chartify chart-builder plugin for WordPress. User-controllable input is reflected back into the HTTP response without proper output encoding or sanitization. When a browser renders the response, injected script content is interpreted as part of the page.
The attack requires user interaction. A victim must click a crafted link or submit a specially formed request to trigger the payload. Once executed, the script runs with the privileges of the current session, including any authenticated WordPress user viewing the response.
The scope-changing nature of the vulnerability means code injected through the plugin can affect other components of the WordPress site. This includes reading Document Object Model (DOM) content, cookies not marked HttpOnly, and issuing authenticated requests against the site.
Root Cause
The root cause is missing input neutralization on parameters processed by the Chartify plugin. Data received from HTTP request parameters is echoed into HTML responses without contextual escaping. This maps directly to [CWE-79], Improper Neutralization of Input During Web Page Generation.
Attack Vector
Exploitation occurs over the network without authentication but requires user interaction. An attacker delivers a malicious URL through phishing, social media, or a compromised site. When the victim clicks the link, the browser sends the crafted request to the vulnerable WordPress site, and the reflected payload executes.
See the Patchstack WordPress Vulnerability Report for additional technical details.
Detection Methods for CVE-2024-47347
Indicators of Compromise
- HTTP requests to Chartify plugin endpoints containing URL-encoded <script> tags, javascript: URIs, or on* event handler attributes
- Web server access logs showing long query strings with encoded HTML entities targeting chart-builder parameters
- Unexpected WordPress administrator account creation or privilege changes following user clicks on external links
- Outbound requests from browsers of authenticated users to attacker-controlled domains referenced in Chartify URLs
Detection Strategies
- Inspect Web Application Firewall (WAF) logs for reflected XSS signatures targeting query parameters processed by the chart-builder plugin
- Correlate HTTP referrer headers with suspicious outbound URLs pointing to Chartify endpoints containing script payloads
- Monitor WordPress audit logs for administrative actions immediately following authenticated sessions viewing external links
Monitoring Recommendations
- Deploy Content Security Policy (CSP) reporting to capture blocked inline script execution attempts on WordPress pages
- Enable verbose logging on WordPress and reverse proxies to record full request URIs for Chartify plugin routes
- Alert on anomalous session activity such as cookie theft indicators or unexpected API calls from admin accounts
How to Mitigate CVE-2024-47347
Immediate Actions Required
- Identify all WordPress installations using the Chartify (chart-builder) plugin and verify installed versions
- Update Chartify to a version later than 2.7.6 once released by Ays Pro, or deactivate and remove the plugin
- Force logout of all WordPress administrator sessions and rotate credentials if exploitation is suspected
- Apply virtual patching through a WAF ruleset that blocks script payloads targeting Chartify parameters
Patch Information
At the time of publication, the vulnerability affects Chartify versions up to and including 2.7.6. Administrators should consult the Patchstack advisory for the latest fixed version information and vendor guidance.
Workarounds
- Deactivate the Chartify plugin until a patched version is installed
- Restrict access to WordPress admin URLs by IP allowlisting through the web server or reverse proxy
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
- Train users to avoid clicking untrusted links referencing the WordPress site's Chartify endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
