CVE-2025-12753: Chart Expert WordPress Plugin XSS Vulnerability

CVE-2025-12753 Overview

CVE-2025-12753 is a Stored Cross-Site Scripting (XSS) vulnerability in the Chart Expert plugin for WordPress. The flaw affects all versions up to and including 1.0. The root cause is insufficient input sanitization and output escaping on user-supplied attributes of the pmzez_chart shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. Those scripts execute in the browser of any user who visits the affected page. The vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
Contributor-level users can persist JavaScript payloads into published pages, enabling session theft, forced redirects, and administrative account takeover when higher-privileged users view the injected content.

Affected Products

Chart Expert plugin for WordPress — all versions through 1.0
WordPress sites permitting contributor-level or higher registrations
Any page rendering the pmzez_chart shortcode with attacker-controlled attributes

Discovery Timeline

2025-11-11 - CVE-2025-12753 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12753

Vulnerability Analysis

The Chart Expert plugin registers the pmzez_chart shortcode to render chart elements from user-supplied attributes. The shortcode handler defined in inc/shortcode.php accepts attribute values and reflects them into the rendered HTML output without adequate sanitization or contextual output escaping. A contributor who authors a post can supply attribute values containing HTML or JavaScript. Those payloads are persisted with the post and executed when any visitor renders the page.

The issue is a stored XSS because payloads are saved in the WordPress database as part of post content. Every subsequent visitor triggers execution in their browser session. Because contributor accounts require only self-registration on many WordPress sites, the attack surface can be broad. When an administrator previews or reviews the malicious draft, the injected script executes with administrator session context, enabling account takeover.

Root Cause

The shortcode callback in inc/shortcode.php passes user-supplied shortcode attributes into page output without applying WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses(). Shortcode attributes should be treated as untrusted input. See the vulnerable code paths referenced by WordPress Chart Expert shortcode.php L1 and WordPress Chart Expert shortcode.php L95.

Attack Vector

An authenticated attacker with contributor privileges creates a post containing the pmzez_chart shortcode with a crafted attribute value carrying a JavaScript payload. After the post is submitted for review or published, any user who loads the page executes the injected script. The attack requires no user interaction beyond viewing the page. Additional detail is available in the Wordfence Vulnerability Report.

The vulnerability is described in prose only; no verified public proof-of-concept code is included here.

Detection Methods for CVE-2025-12753

Indicators of Compromise

Posts or pages containing pmzez_chart shortcode attributes with HTML tags such as <script>, onerror=, or onload=.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages rendering the shortcode.
New administrator accounts or modified user roles following contributor activity.

Detection Strategies

Query the wp_posts table for post_content values matching pmzez_chart combined with suspicious characters such as <, javascript:, or event handler attributes.
Review web server access logs for contributor-authored posts followed by anomalous session activity on administrator accounts.
Enable a Content Security Policy (CSP) in report-only mode to surface inline script violations from rendered pages.

Monitoring Recommendations

Alert on creation or modification of posts by contributor-role accounts that include shortcode attributes containing angle brackets or quotes.
Monitor plugin file integrity for chart-expert/inc/shortcode.php and other plugin files.
Track authentication events and privilege changes to detect follow-on account takeover after XSS execution.

How to Mitigate CVE-2025-12753

Immediate Actions Required

Deactivate and remove the Chart Expert plugin until a patched release is available.
Audit existing posts and pages for use of the pmzez_chart shortcode and remove suspicious attribute content.
Restrict new user registrations at the contributor level and review existing contributor accounts.

Patch Information

As of the latest NVD update, no patched version beyond 1.0 has been published for the Chart Expert plugin. Site owners should monitor the Wordfence Vulnerability Report and the WordPress plugin repository for a fixed release, then upgrade immediately when available.

Workarounds

Remove the plugin entirely if chart functionality is not essential.
Restrict the pmzez_chart shortcode by unregistering it via a mu-plugin using remove_shortcode('pmzez_chart') until a patch is released.
Deploy a Web Application Firewall (WAF) rule that blocks shortcode attributes containing script tags or JavaScript event handlers.
Enforce a strict Content Security Policy that disallows inline scripts to limit payload execution.

bash

# Configuration example: disable the vulnerable shortcode via a must-use plugin
# File: wp-content/mu-plugins/disable-pmzez-chart.php
<?php
add_action('init', function () {
    if (shortcode_exists('pmzez_chart')) {
        remove_shortcode('pmzez_chart');
    }
}, 20);