CVE-2024-8622 is a reflected cross-site scripting vulnerability in the amCharts: Charts and Maps WordPress plugin (versions up to 1.4.4). It occurs due to improper neutralization of input in the 'amcharts_javascript' parameter and lack of nonce validation on the preview feature, enabling unauthenticated attackers to inject and execute arbitrary JavaScript by tricking users into clicking malicious links. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and limited confidentiality and integrity impact without availability impact. No patch or official fix is currently documented.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when the victim interacts with a crafted link. This can lead to limited confidentiality and integrity impacts such as theft of sensitive information or manipulation of page content. There is no impact on system availability. The vulnerability affects all versions up to and including 1.4.4 of the plugin. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the preview functionality that processes the 'amcharts_javascript' parameter or implement web application firewall (WAF) rules to detect and block suspicious input patterns. Users should also educate users to avoid clicking untrusted links that could trigger the vulnerability.