CVE-2025-30904: WordPress Chartify plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability
Published Mar 27, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Stored XSS.This issue affects Chartify: from n/a through <= 3.1.7.
Affected Software
1 affected component
Ays Pro Chartify<=3.1.7
Remediation
Information
Update the WordPress Chartify plugin to the latest available version (at least 3.1.9).
Event History
Mar 27, 2025
CVE Published
via MITRE·10:55 AM
Data Sourced
via MITRE·10:55 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-30904?
CVE-2025-30904 has a high severity level due to the potential for Stored XSS attacks.
2
How do I fix CVE-2025-30904?
To fix CVE-2025-30904, update Ays Pro Chartify to version 3.1.8 or later.
3
Which versions of Ays Pro Chartify are affected by CVE-2025-30904?
Versions of Ays Pro Chartify from n/a to 3.1.7 are affected by CVE-2025-30904.
4
Does CVE-2025-30904 affect WordPress Chartify?
Yes, CVE-2025-30904 affects WordPress Chartify up to version 3.1.7.
5
What type of vulnerability is CVE-2025-30904?
CVE-2025-30904 is an improper neutralization of input during web page generation, specifically a Stored XSS vulnerability.