CVE-2024-7355 is a stored cross-site scripting vulnerability in the wpdevart Organization chart WordPress plugin affecting all versions up to and including 1.5.0. The issue stems from improper neutralization of input in the 'title_input' and 'node_description' parameters, enabling authenticated users with low privileges to inject arbitrary scripts that execute when a user views the affected page. The vulnerability requires authentication with at least Subscriber-level access and has a CVSS 3.1 base score of 4.9 (medium severity). No patch or vendor advisory indicating remediation is currently available.

Successful exploitation allows an authenticated user with Subscriber-level or higher privileges to inject and execute arbitrary JavaScript in the context of the affected site. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of other users. The vulnerability does not impact availability. Exploitation is constrained by the need for authentication and the plugin's configuration, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users and limit Subscriber-level permissions where possible. Avoid granting chart configuration capabilities to low-privilege users. Monitor for plugin updates from wpdevart and apply them promptly once available.