CVE-2019-16931

6.1 mediumEPSS 3.3%

Medium (6.1) in themeisle visualizer. EPSS 3.3% chance of exploitation in the next 30 days.

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-10-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

themeisle:visualizer

References

https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf
https://wordpress.org/plugins/visualizer/#developers
https://wpvulndb.com/vulnerabilities/9893
https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf
https://wordpress.org/plugins/visualizer/#developers

Check your stack JSON