CVE-2025-2703

A DOM-based Cross-site scripting vulnerability exists in Grafana's built-in XY Chart plugin. This flaw allows an attacker with editor-level privileges to inject and execute arbitrary JavaScript code by editing an XY Chart Panel. The vulnerability bypasses the Content Security Policy, allowing the...

XSS in Grafana XY Chart Plugin

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript. This vulnerability first appeared in Grafana v11.1.0, and is fixed in 11.6.0+security-01, 11.5.3+security-01,...

Grafana 安全漏洞

Grafana is a set of open source monitoring tools from Grafana open source that provides a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A security vulnerability exists in Grafana version v11.1.0, which stems from a...

PT-2025-17601 · Unknown +1 · Xy Chart Plugin +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The built-in XY Chart plugin is affected by a DOM XSS issue. A user with Editor permissions can modify a panel to execute arbitrary JavaScript. Recommendations: At the moment, there is no...

Grafana -- DOM XSS vulnerability

Grafana Labs reports: An external security researcher responsibly reported a security vulnerability in Grafana’s built-in XY chart plugin that is vulnerable to a DOM XSS vulnerability. The CVSS score for this vulnerability is 6.8 MEDIUM...

WordPress Organization chart plugin <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via titleinput and nodedescription Parameters vulnerability discovered by Norbert Hofmann in WordPress Plugin Organization chart versions = 1.5.0...

PT-2024-38286 · WordPress · Organization Chart Plugin

Name of the Vulnerable Software and Affected Versions: Organization chart plugin for WordPress versions up to, and including, 1.5.0 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Subscriber-level access and above to...

WordPress plugin Organization chart 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-47526

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allows Stored XSS.This issue affects Chartify – WordPress Chart Plugin: from n/a through 2.0.6...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Gangesh Matta Simple Org Chart plugin = 2.3.4 versions...

CVE-2023-40008

CVE-2023-40008 affects the Gangesh Matta Simple Org Chart WordPress plugin, with CSRF in versions prior to 2.3.4. The Red Hat entry, NVD, and other sources corroborate a Cross-Site Request Forgery vulnerability present in plugin versions

CVE-2023-23892

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Jamie Poitra M Chart plugin = 1.9.4 versions...

CVE-2023-23892

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Jamie Poitra M Chart plugin = 1.9.4 versions...

CVE-2023-23892 WordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Jamie Poitra M Chart plugin = 1.9.4 versions...

WordPress Plugin M Chart 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-24387

WPdevart Organization chart plugin for WordPress is affected in versions

PT-2023-19548 · Wpdevart · Wpdevart Organization Chart Plugin

Name of the Vulnerable Software and Affected Versions: WPdevart Organization chart plugin versions prior to 1.4.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to...

CVE-2022-2409

The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-16459 · WordPress · Rough Chart Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Rough Chart WordPress plugin versions through 1.0.0 Description: The issue concerns the Rough Chart WordPress plugin, which does not properly escape chart data labels. This could allow high-privilege users to perform Cross-Site Scripting...

com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (=2.4.0), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (=2.4.0) +68 more potentially affected by CVE-2016-3087 via org.apache.struts:struts2-core (>=2.3.1.1 <=2.3.20.1)

org.apache.struts:struts2-core MAVEN version =2.3.1.1, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.1.0, =1.1.0, =2.0.1 - com.jgeppert.struts2.jquery:struts2-jquery-chart-plugin =3.3.0 - com.jgeppert.struts2.jquery:struts2-jquery-grid-plugin =3.3.0 - com.jgeppert.struts2.jquery:struts2-jquery-mobile-plugin...