Chargemap had a stored cross-site scripting (XSS) vulnerability in its account registration page. An unauthenticated attacker could inject malicious script code into the username field when creating an account linked to a victim's email. When the victim received and opened a forgotten password email containing the payload, the script would execute. This vulnerability was fixed on 2026-07-17.