Executive brief
The Visualizer plugin, a popular charting tool for WordPress, fails to properly sanitize user input when storing chart configuration data. Attackers with contributor-level access or higher can inject malicious JavaScript that executes when administrators view the affected charts, potentially allowing account takeover, data theft, or malware installation on site administrators' browsers.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the Visualizer WordPress plugin's chart editor. The vulnerability exists because the plugin does not sanitize or escape a chart's JSON data source configuration before rendering it back in the editor interface. An attacker with Contributor role or above can craft a malicious JSON payload containing JavaScript code and save it as part of a chart configuration. When any higher-privileged user (such as an administrator) views or edits that chart, the stored JavaScript executes in their browser with their privileges. The vulnerability affects versions before 4.0.8 and has been patched in version 4.0.8 and later.
Affected products
- ThemeIsle Visualizer before 4.0.8
Timeline
- 2026-09-14: disclosed
- 2026-09-15: advisory
- 2026-09-16: patched: version 4.0.8