The iChart – Easy Charts and Graphs WordPress plugin (versions up to 2.1.0) suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'width' parameter. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users visiting the compromised page. This vulnerability is tracked as CVE-2024-11928 and has a CVSS 3.1 base score of 6.4 (medium severity). No known exploits are reported in the wild, and no patch or remediation details are provided by the vendor at this time.

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to inject persistent malicious scripts into pages generated by the plugin. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of other users viewing the injected content. There is no impact on availability reported. The vulnerability requires authentication and privileges, which limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or replacing the vulnerable plugin to prevent exploitation. Monitor for updates from the vendor or security advisories for any released patches or mitigations.