What is the CVSS score of CVE-2026-4730?

CVE-2026-4730 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Charts Ninja WordPress Plugin CVE-2026-4730

EUVD-2026-27183 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

GHSA-q9gg-cpq5-g6mh

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:30 vuln.today

DescriptionCVE.org

The Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'chartid' shortcode attribute in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Charts Ninja: Create Beautiful Graphs & Charts plugin for WordPress (all versions up to 2.1.0) allows authenticated contributors and above to inject arbitrary JavaScript via the 'chartid' shortcode attribute due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially compromising site visitors and administrative accounts. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

Charts Ninja is a WordPress plugin that provides shortcode functionality to embed charts and graphs into posts and pages. The vulnerability exists in the shortcode handler that processes the 'chartid' parameter without proper sanitization before output. The underlying issue is a Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-supplied input from the shortcode attribute is stored in the WordPress database and later rendered on the page without HTML entity encoding or JavaScript context escaping. This allows attackers to embed malicious scripts that persist in the database and execute every time the page is served to any user, including administrators.

RemediationAI

Update the Charts Ninja plugin to a version newer than 2.1.0 once available from the plugin developer or WordPress plugin repository. Until a patched version is released, site administrators should restrict Contributor-level access to only trusted users and monitor contributor accounts for suspicious activity. WordPress administrators can also disable the Charts Ninja plugin entirely if not actively in use, or restrict shortcode functionality to administrators only via custom code modifications. Consider implementing a Web Application Firewall (WAF) rule to detect and block script injection patterns in shortcode attributes as a compensating control, though this may generate false positives and requires ongoing maintenance.