Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-86784: Visualizer plugin lets contributors run code in admin browsers
CVE-2026-86784 · published 1 month ago
Summary
The Visualizer add‑on for WordPress versions before 4.0.8 does not clean up chart data that is entered as JSON. A user with Contributor rights can insert JavaScript that will run when an administrator opens the chart editor, potentially letting the attacker hijack the admin’s browser session. Upgrade the plugin to version 4.0.8 or later, or remove any untrusted chart configurations until the update is applied.
What to do
- Update unknown visualizer to version 4.0.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | visualizer | < 4.0.8 |
Original advisory text
Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.8
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Sep 2026
Updated4 Nov 2026
First seen16 Sep 2026
Track software like this
Free during beta