WordPress Plugin Vulnerabilities

Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

Description

The plugin does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.

Proof of Concept

Affects Plugins

Plugin icon
visualizer
Fixed in 4.0.8

References

CVE
CVE-2026-86784

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Yaswanth Reddy Sunkara
Submitter
Yaswanth Reddy Sunkara
Verified
Yes
WPVDB ID
9ac2d380-62fd-4967-8697-40175ffdf1c7

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-15 (about 17 hours ago)
Last Updated
2026-09-15 (about 17 hours ago)

Other

Published
Title
Published
2025-01-14
Title
WP Projects Portfolio with Client Testimonials <= 3.0 - Stored XSS via CSRF
Published
2024-10-31
Title
Themedy Toolbox <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-01-18
Title
Translation Exchange <= 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2015-11-05
Title
neuvoo-jobroll <= 2.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2023-11-08
Title
Elementor Website Builder < 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()