What is the CVSS score of CVE-2026-15653?

CVE-2026-15653 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Visualizer WordPress Plugin CVE-2026-15653

EUVD-2026-48510 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-rpx9-q8jg-qm8q

WordPress XSS Wordpress Plugin Visualizer Tables Charts Manager With Built In Ai Generator Themeisle

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects required contributor access; UI:R corrects the provided vector since a victim must load the injected page; S:C retained as script executes in other users' browser contexts.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:53 vuln.today

CVE Published

Jul 24, 2026 - 06:52 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Visualizer - Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.

Technical ContextAI

The vulnerability resides in the Themeisle Visualizer plugin (CPE: cpe:2.3:a:themeisle:visualizer_-_tables_&_charts_manager_with_built-in_ai_generator:*:*:*:*:*:*:*:*), a WordPress data-visualization tool that renders charts and tables with an AI-assisted generation interface. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), manifesting in the 'backend-title' parameter handled in at least three source files: classes/Visualizer/Render/Page/Data.php (line 96) and classes/Visualizer/Module/Chart.php (lines 826 and 553). User-supplied title data flows from these modules to page output without being passed through WordPress's standard sanitization (sanitize_text_field) or escaping functions (esc_html/esc_attr), allowing arbitrary HTML and script tags to survive the round-trip to the browser. Because the payload is stored in the database rather than reflected in a single response, every subsequent page load replays the attack to all visitors.

RemediationAI

Update the Visualizer plugin to a version beyond 4.0.5 immediately. A code fix has been committed in WordPress plugin repository changeset 3619025 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3619025%40visualizer&new=3619025%40visualizer); however, the exact released patched version number is not independently confirmed from the available intelligence - verify the current version in the WordPress plugin directory before updating. As a compensating control if immediate patching is not possible: restrict contributor-level role assignment to only fully trusted users, and consider temporarily disabling the Visualizer plugin on sites with open or semi-open user registration. WordPress administrators can also deploy a Web Application Firewall rule blocking script tags and JavaScript event handlers in POST parameters targeting the plugin's backend-title field; this adds latency to request processing but does not require downtime. Do not rely on browser-side filters (Content Security Policy alone) as the primary mitigation, since stored payloads bypass CSP when inline scripts are permitted by the site's policy.