Stored Cross-Site Scripting Vulnerability in Visualizer Tables & Charts Manager Plugin by WordPress
CVE-2026-15653

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Visualizer – Tables & Charts Manager With Built-in Ai Generator
Vendor
CVE Published:
24 July 2026

What is CVE-2026-15653?

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate sanitization of the 'backend-title' parameter. This flaw allows authenticated users with contributor-level access or higher to inject arbitrary web scripts, which are executed when any user opens the compromised page. This presents a significant security risk, as attackers can exploit this vulnerability to execute malicious scripts in the context of the affected site.

Affected Version(s)

Visualizer – Tables & Charts Manager with Built-in AI Generator 0 <= 4.0.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/visualizer/tag...
https://plugins.trac.wordpress.org/browser/visualizer/tag...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.