Visualizer Tables Charts Manager With Built In Ai Generator
Monthly
We need to produce a JSON object with the required fields. Let's analyze the provided data. CVE: CVE-2026-13468 Description: The Visualizer - Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site - including charts in draft, private, pending, future, or trash status - as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely. CVSS Score: 7.5, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE: CWE-862 (Missing Authorization) EPSS: 0.37% (percentile 29%) Reported by: Wordfence CPE: cpe:2.3:a:themeisle:visualizer_–_tables_&_charts_manager_with_built-in_ai_generator:*:*:*:*:*:*:*:* Tags: Authentication Bypass, WordPress, Visualizer Tables Charts Manager With Built In Ai Generator SSVC: Exploitation: none, Automatable: yes, Technical Impact: partial ENISA EUVD: EUVD-2026-40892; Affected versions: ["Visualizer – Tables & Charts Manager with Built-in AI Generator 0 ≤4.0.3"] References: Wordfence advisory, multiple Trac links, NVD link. Now we need to output JSON. Each field is a string. We'll follow the instructions precisely. product_name: "Visualizer" maybe? The product is "Visualizer - Tables & Charts Manager with Built-in AI Generator" but we need 1-3 words. Could use "Visualizer for WordPress". The rules: product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'L
Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.
We need to produce a JSON object with the required fields. Let's analyze the provided data. CVE: CVE-2026-13468 Description: The Visualizer - Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site - including charts in draft, private, pending, future, or trash status - as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is particularly impactful because the standard WordPress REST endpoint for the non-public 'visualizer' custom post type correctly enforces capability checks and returns HTTP 401 to unauthenticated callers, whereas this plugin-registered route circumvents that protection entirely. CVSS Score: 7.5, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE: CWE-862 (Missing Authorization) EPSS: 0.37% (percentile 29%) Reported by: Wordfence CPE: cpe:2.3:a:themeisle:visualizer_–_tables_&_charts_manager_with_built-in_ai_generator:*:*:*:*:*:*:*:* Tags: Authentication Bypass, WordPress, Visualizer Tables Charts Manager With Built In Ai Generator SSVC: Exploitation: none, Automatable: yes, Technical Impact: partial ENISA EUVD: EUVD-2026-40892; Affected versions: ["Visualizer – Tables & Charts Manager with Built-in AI Generator 0 ≤4.0.3"] References: Wordfence advisory, multiple Trac links, NVD link. Now we need to output JSON. Each field is a string. We'll follow the instructions precisely. product_name: "Visualizer" maybe? The product is "Visualizer - Tables & Charts Manager with Built-in AI Generator" but we need 1-3 words. Could use "Visualizer for WordPress". The rules: product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'L
Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.