Skip to main content

Visualizer Tables Charts Manager With Built In Ai Generator

2 CVEs product

Monthly

CVE-2026-13468 Jul 01, 03:43 HIGH This Week

Authorization bypass in the Themeisle Visualizer - Tables & Charts Manager plugin (all versions ≤ 4.0.3) exposes a plugin-registered REST endpoint `/wp-json/visualizer/v1/action/{chart}/{type}/` that lacks the capability checks WordPress enforces on the standard `visualizer` custom post type REST routes. Unauthenticated remote attackers can enumerate and export the full contents of any chart on the site-including charts in draft, private, pending, future, or trash post status-as CSV, Excel, or HTML without any credentials. No public exploit code has been confirmed and CISA KEV does not list this CVE, though SSVC rates it Automatable:yes, making scripted mass-scanning across WordPress installations practical.

WordPress Wordpress Plugin Visualizer Tables Charts Manager With Built In Ai Generator
NVD
CVSS 3.1
7.5
EPSS
0.4%
CVE-2026-15653 Jul 24, 06:52 MEDIUM This Month

Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.

WordPress XSS Wordpress Plugin Visualizer Tables Charts Manager With Built In Ai Generator Themeisle
NVD
CVSS 3.1
6.4
EPSS
0.2%
EPSS 0% CVSS 7.5
HIGH This Week

Authorization bypass in the Themeisle Visualizer - Tables & Charts Manager plugin (all versions ≤ 4.0.3) exposes a plugin-registered REST endpoint `/wp-json/visualizer/v1/action/{chart}/{type}/` that lacks the capability checks WordPress enforces on the standard `visualizer` custom post type REST routes. Unauthenticated remote attackers can enumerate and export the full contents of any chart on the site-including charts in draft, private, pending, future, or trash post status-as CSV, Excel, or HTML without any credentials. No public exploit code has been confirmed and CISA KEV does not list this CVE, though SSVC rates it Automatable:yes, making scripted mass-scanning across WordPress installations practical.

WordPress Wordpress Plugin Visualizer Tables Charts Manager With Built In Ai Generator
NVD
EPSS 0% CVSS 6.4
MEDIUM This Month

Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.

WordPress XSS Wordpress Plugin +2
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy