CVE-2024-7355

The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure charts can be extended to subscribers.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L207Product
• https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L217Product
• https://plugins.trac.wordpress.org/changeset/3131569/#file0Patch
• https://wordpress.org/plugins/organization-chart/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/04641506-5b0e-48bc-ad50-c81dda996ecf?source=cveThird Party Advisory

Published

Aug 7, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7349The LifterLMS – WP LMS for eLearning, Online Courses, & Quiz…7.2
• CVE-2024-7350The Appointment Booking Calendar Plugin and Online Schedulin…9.8
• CVE-2024-7351The Simple Job Board plugin for WordPress is vulnerable to P…7.2
• CVE-2024-7352PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remo…7.8
• CVE-2024-7353The Accept Stripe Payments plugin for WordPress is vulnerabl…5.4
• CVE-2024-7354The Ninja Forms WordPress plugin before 3.8.11 does not esc…6.1
• CVE-2024-7356The Zephyr Project Manager plugin for WordPress is vulnerabl…5.4
• CVE-2024-7357** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…9.8
• CVE-2024-7358A vulnerability was found in Point B Ltd Getscreen Agent 2.1…8.5
• CVE-2024-7359A vulnerability was found in SourceCodester Tracking Monitor…6.1
• CVE-2024-7360A vulnerability classified as problematic has been found in …8.8
• CVE-2024-7361A vulnerability classified as critical was found in SourceCo…9.8