CVE-2026-86784 in Visualizer Plugin
Summary
by MITRE • 09/16/2026
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Visualizer WordPress plugin prior to version 4.0.8 contains a critical stored cross-site scripting vulnerability rooted in insufficient input validation and output encoding mechanisms within its chart editor functionality. This security flaw specifically affects how JSON data source configurations are processed when users attempt to create or modify charts. The core technical deficiency lies in the application's failure to properly sanitize user-supplied input before storing it, coupled with a lack of appropriate escaping when that same data is rendered back into the browser context for editing purposes. Because the plugin accepts complex configuration structures including JSON payloads from contributors and higher-privileged roles without rigorous validation against executable script patterns, attackers can inject malicious JavaScript code directly into these configuration fields. This represents a classic case where trusted application contexts are exploited to execute arbitrary client-side scripts under the guise of legitimate data entry operations.
The operational impact of this vulnerability is significant due to its stored nature and the specific privilege level required for exploitation. Unlike reflected XSS attacks that require tricking users into clicking malicious links, this flaw allows an attacker with Contributor role or higher to persistently embed malicious code within a chart configuration. When an administrator or any user with elevated privileges subsequently views or edits the affected chart in the visualizer interface, their browser automatically executes the injected JavaScript payload. This execution occurs within the context of the WordPress admin dashboard, granting the attacker full access to all cookies, session tokens, and local storage associated with that administrative account. Consequently, an attacker can hijack administrator sessions, perform actions on behalf of the site owner such as installing malicious plugins or modifying core files, exfiltrate sensitive database contents, or deface the website interface. The ability for lower-privileged users to impact higher-privileged accounts creates a dangerous privilege escalation pathway that undermines the fundamental security model of multi-user WordPress installations.
From an industry standards perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and more specifically CWE-830 Inclusion of Functionality from Untrusted Control Sources when considering how unvalidated JSON structures are processed. The attack vector corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where the injected JavaScript serves as a script execution mechanism for further exploitation. Additionally, it relates to CWE-602 Client-Side Injection of Malicious Code which highlights the risk of storing executable payloads in client-facing applications that are later rendered by privileged users. The persistence aspect also touches upon T1505 Server Software Component where malicious code is embedded within legitimate software components for long-term access and control.
Mitigation strategies must address both immediate remediation and long-term security hygiene. Administrators should immediately update the Visualizer plugin to version 4.0.8 or later, as this release includes patches that enforce strict sanitization of JSON data sources and implement proper output encoding before rendering in the editor interface. For sites unable to upgrade instantly, implementing a Web Application Firewall rule set capable of detecting and blocking JavaScript injection patterns within POST requests targeting chart configuration endpoints can provide temporary protection. It is also advisable to review user roles and restrict the ability to create or edit charts only to users with Administrator privileges if business requirements allow, thereby reducing the attack surface available to lower-privileged accounts. Regular security audits focusing on input validation and output encoding practices across all custom plugins are essential to prevent similar vulnerabilities from emerging in other parts of the WordPress ecosystem.