Cross-Site Scripting Vulnerability in Visualizer Plugin by WordPress
CVE-2026-86784

Currently unrated

Key Information:

Vendor

WordPress
Status
Visualizer
Vendor
CVE Published:
16 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86784?

The Visualizer WordPress plugin prior to version 4.0.8 is susceptible to a cross-site scripting vulnerability due to improper sanitization and escaping of JSON data source configurations in the chart editor. This flaw enables users with Contributor roles or higher to inject malicious JavaScript, which can execute in the browser of any higher-privileged user, including administrators, who review the compromised charts. This can lead to unauthorized actions and data exposure for users with elevated permissions.

Affected Version(s)

Visualizer 0 < 4.0.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86784 - Proof of Concept

References

https://wpscan.com/vulnerability/9ac2d380-62fd-4967-8697-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaswanth Reddy Sunkara
WPScan
.