Visualizer
Monthly
SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only Contributor-level privileges to inject arbitrary SQL into backend database queries, enabling extraction of sensitive data such as user credentials and secrets. Reported by Patchstack and tracked under CWE-89, the flaw carries a CVSS 8.5 (scope-changed) rating; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The low privilege bar (Contributor is a common, low-trust role on multi-author sites) makes this a meaningful risk for any site that grants untrusted users content-contribution access.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding at least the Contributor role to publish, rename, and overwrite posts and pages belonging to other users - including private drafts they would normally have no access to. The flaw stems from chart-building AJAX/REST actions that do not verify post ownership before acting on the supplied post identifier. A publicly available proof-of-concept exploit exists, confirmed by WPScan research; no active exploitation (CISA KEV) has been reported.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to permanently delete charts created by other users, including administrators, by exploiting a missing per-chart ownership check on deletion requests. The plugin validates only a site-wide capability (confirming the user can edit content generally) but never verifies whether the requesting user owns the specific chart being deleted - a classic BOLA/IDOR pattern under CWE-862. A publicly available proof-of-concept from WPScan demonstrates trivial exploitation with any valid Contributor account. No public exploitation (KEV) status is confirmed at time of analysis.
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Server-Side Request Forgery in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to pivot through the WordPress server and reach link-local instance-metadata endpoints (e.g., 169.254.169.254), returning the full response to the attacker. On cloud-hosted WordPress deployments (AWS, GCP, Azure), this enables non-blind exfiltration of IAM credentials and other instance metadata, potentially leading to full cloud account compromise. A publicly available proof-of-concept exploit exists; exploitation probability is currently low (EPSS 0.14%, 3rd percentile) but the concrete cloud-credential impact makes this a material priority for cloud-hosted sites.
Missing authorization on three AJAX handlers in the Visualizer: Tables and Charts Manager plugin for WordPress (by Themeisle) allows authenticated attackers with Subscriber-level access to create arbitrary chart posts and read or overwrite chart data owned by any site user, including administrators. The wp_ajax_visualizer-create-chart, wp_ajax_visualizer-edit-chart, and wp_ajax_visualizer-upload-data actions invoke renderChartPages() and uploadData() without any current_user_can() capability check; the nonce validation in uploadData() is further trivialized by the absence of an action argument, making it bypassable with any valid WordPress nonce. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 4.0.1.
Stored XSS in the Themeisle Visualizer WordPress plugin (all versions before 4.0.0) allows an authenticated low-privileged user to inject persistent malicious scripts into chart or visualization content. When a victim user subsequently views the affected page, the injected script executes in their browser within a changed scope (S:C), meaning impact extends beyond the attacker's own session to other users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this straightforward to abuse on sites with open or loosely controlled contributor registration.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.11.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Reflected XSS.10.5. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only Contributor-level privileges to inject arbitrary SQL into backend database queries, enabling extraction of sensitive data such as user credentials and secrets. Reported by Patchstack and tracked under CWE-89, the flaw carries a CVSS 8.5 (scope-changed) rating; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The low privilege bar (Contributor is a common, low-trust role on multi-author sites) makes this a meaningful risk for any site that grants untrusted users content-contribution access.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding at least the Contributor role to publish, rename, and overwrite posts and pages belonging to other users - including private drafts they would normally have no access to. The flaw stems from chart-building AJAX/REST actions that do not verify post ownership before acting on the supplied post identifier. A publicly available proof-of-concept exploit exists, confirmed by WPScan research; no active exploitation (CISA KEV) has been reported.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to permanently delete charts created by other users, including administrators, by exploiting a missing per-chart ownership check on deletion requests. The plugin validates only a site-wide capability (confirming the user can edit content generally) but never verifies whether the requesting user owns the specific chart being deleted - a classic BOLA/IDOR pattern under CWE-862. A publicly available proof-of-concept from WPScan demonstrates trivial exploitation with any valid Contributor account. No public exploitation (KEV) status is confirmed at time of analysis.
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Server-Side Request Forgery in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to pivot through the WordPress server and reach link-local instance-metadata endpoints (e.g., 169.254.169.254), returning the full response to the attacker. On cloud-hosted WordPress deployments (AWS, GCP, Azure), this enables non-blind exfiltration of IAM credentials and other instance metadata, potentially leading to full cloud account compromise. A publicly available proof-of-concept exploit exists; exploitation probability is currently low (EPSS 0.14%, 3rd percentile) but the concrete cloud-credential impact makes this a material priority for cloud-hosted sites.
Missing authorization on three AJAX handlers in the Visualizer: Tables and Charts Manager plugin for WordPress (by Themeisle) allows authenticated attackers with Subscriber-level access to create arbitrary chart posts and read or overwrite chart data owned by any site user, including administrators. The wp_ajax_visualizer-create-chart, wp_ajax_visualizer-edit-chart, and wp_ajax_visualizer-upload-data actions invoke renderChartPages() and uploadData() without any current_user_can() capability check; the nonce validation in uploadData() is further trivialized by the absence of an action argument, making it bypassable with any valid WordPress nonce. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 4.0.1.
Stored XSS in the Themeisle Visualizer WordPress plugin (all versions before 4.0.0) allows an authenticated low-privileged user to inject persistent malicious scripts into chart or visualization content. When a victim user subsequently views the affected page, the injected script executes in their browser within a changed scope (S:C), meaning impact extends beyond the attacker's own session to other users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this straightforward to abuse on sites with open or loosely controlled contributor registration.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.11.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Reflected XSS.10.5. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.