Medium severity · published Oct 3, 2019
CVE-2019-16931
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user…
6.1
CVSS
3.3%
EPSS
No
On KEV
Description
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Visualizer · Themeisle
through 3.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16931
Exploit
https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf
Product
https://wordpress.org/plugins/visualizer/#developers
Exploit
https://wpvulndb.com/vulnerabilities/9893
More from Visualizer
10.0
CVE-2019-16932
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data
8.8
CVE-2024-35736
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.This issue affects Visualizer: from n/a through 3.11.1
8.8
CVE-2022-2444
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to,…
8.5
CVE-2026-65526
WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability
6.5
CVE-2026-24573
WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability