CVE-2025-30904: Chartify Chart-Builder Stored XSS Vulnerability

CVE-2025-30904 Overview

CVE-2025-30904 is a stored Cross-Site Scripting (XSS) vulnerability in the Ays Pro Chartify plugin for WordPress, also known as chart-builder. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers with high-privilege access can inject malicious scripts that persist in the application and execute when other users load affected pages. The vulnerability affects all Chartify versions up to and including 3.1.7. Successful exploitation requires user interaction and can result in session compromise, content manipulation, and pivoting into administrative workflows through the victim's browser context.

Critical Impact
Stored XSS payloads persist within the Chartify plugin and execute in the browsers of users who view affected chart content, enabling cross-context script execution against the WordPress site.

Affected Products

Ays Pro Chartify (chart-builder) WordPress plugin
All versions from initial release through 3.1.7
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-03-27 - CVE CVE-2025-30904 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30904

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in the Chartify chart builder. The plugin fails to properly sanitize and encode user-supplied input before rendering it back into web page output. An authenticated attacker with elevated privileges can submit crafted input containing HTML or JavaScript payloads through the plugin's chart configuration interfaces. The malicious content is persisted in the WordPress database and later rendered to any user who views the affected chart or admin view. Because the scope is changed per the CVSS vector, the injected script can affect resources beyond the vulnerable component itself.

Root Cause

The root cause is missing or insufficient output encoding on data flows that originate from user input and terminate in the HTML response. WordPress provides sanitization helpers such as wp_kses_post, esc_html, and esc_attr, but the vulnerable code paths in Chartify 3.1.7 and earlier do not apply appropriate encoding to chart-related fields before echoing them into templates.

Attack Vector

Exploitation requires a network-adjacent attacker with high privileges on the target WordPress instance and interaction from a second user. The attacker authenticates, navigates to a Chartify configuration screen, and stores a payload in a field that is later reflected without encoding. When a victim, typically an administrator or editor, opens a page that renders the poisoned chart data, the script executes in their session context. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-30904

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (for example onerror=, onload=) stored in Chartify chart records within the WordPress database.
Outbound requests from administrator browsers to unfamiliar domains shortly after loading a Chartify chart page.
New or modified WordPress administrator accounts created during sessions where a Chartify page was viewed.

Detection Strategies

Query the WordPress database for Chartify plugin tables and search stored chart fields for HTML tags or JavaScript event handlers.
Enable and review WordPress audit logs for chart create and update actions by high-privilege users.
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution originating from Chartify pages.

Monitoring Recommendations

Monitor web server logs for POST requests to Chartify administrative endpoints containing script tags or URL-encoded payloads.
Track browser telemetry from administrator endpoints for anomalous DOM modifications and outbound connections on pages under /wp-admin/.
Alert on privilege changes, plugin installations, and settings modifications occurring shortly after a Chartify page is rendered.

How to Mitigate CVE-2025-30904

Immediate Actions Required

Upgrade the Chartify plugin to a version later than 3.1.7 as soon as the vendor publishes a fixed release.
Audit existing Chartify chart records for stored payloads and remove any that contain HTML or JavaScript content.
Restrict Chartify configuration access to a minimal set of trusted administrative users and rotate credentials for accounts that could have exploited the flaw.

Patch Information

At the time of the last NVD update on 2026-06-17, the vulnerability is tracked against Chartify versions up to and including 3.1.7. Administrators should consult the Patchstack Vulnerability Report for the current fixed version and apply the vendor patch through the WordPress plugin updater.

Workarounds

Deactivate and remove the Chartify plugin until a patched release is available if the plugin is not business-critical.
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and script event handlers in POST parameters targeting Chartify endpoints.
Enforce a strict Content Security Policy that disallows inline script execution in the WordPress administrative interface.

bash

# Example nginx header enforcing a strict CSP for /wp-admin/
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;