Medium severity6.1NVD Advisory· Published Oct 3, 2019· Updated Jun 17, 2026
CVE-2019-16931
CVE-2019-16931
Description
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/Visualizer plugindescription
Patches
Vulnerability mechanics
References
3- nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrfnvdExploitThird Party Advisory
- wpvulndb.com/vulnerabilities/9893nvdExploitThird Party Advisory
- wordpress.org/plugins/visualizer/nvdProductRelease Notes
News mentions
0No linked articles in our index yet.