CVE-2013-1636: Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart)...

Security readout for executives and security teams

CVE-2013-1636 is an older cross-site scripting issue in the Open Flash Chart SWF file bundled with some CMS plugins and platforms. If exposed on a website, an attacker could make a visitor’s browser run injected script in that site’s context. Business urgency depends on whether legacy WordPress, Joomla, or CiviCRM deployments still expose this SWF. Exposure is most likely on legacy public websites that still host Open Flash Chart assets from the named WordPress, Joomla, or CiviCRM components. Modern deployments are less likely exposed unless old plugin files remain reachable after upgrades or migrations. Prioritize if the organization still runs legacy CMS plugins or CiviCRM versions on internet-facing sites. The issue is old, but public knowledge and website exposure make it relevant for cleanup, especially where user sessions, admin portals, donations, or member data are handled. Mitigation focus: Inventory public web roots for open-flash-chart.swf from affected components.; Update or remove affected Pretty Link Lite, JNews, and CiviCRM installations.; Follow CiviCRM advisory guidance for affected CiviCRM branches..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.