CVE-2026-86784— Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source
Quick assessment
Affected
Unknown Visualizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Visualizer WordPress 插件在 4.0.8 版本之前，未对图表的 JSON 数据源配置进行适当的过滤和转义，就在图表编辑器中将其输出。这使得拥有贡献者（Contributor）权限及以上角色的用户能够存储 JavaScript 代码，当具有更高权限的用户（例如管理员）查看受影响的图表时，该代码会在其浏览器中执行，从而导致存储型跨站脚本（Stored XSS）攻击。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Visualizer | < 4.0.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86784
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source
Source: CVE Program / CVE List V5
Vulnerability Description
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Visualizer | 0 ~ 4.0.8 | - |
|
II. Public POCs for CVE-2026-86784
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86784
请登录查看更多情报信息。
Other References for CVE-2026-86784 (1)
-
🔗 Visualizer < 4.0.8 – Contributor+ Stored XSS via JSON Data Source | CVE 2026-86784 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-16 · 46 CVEs total
| CVE-2026-13407 | 6.1 MEDIUM | Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notifica |
| CVE-2026-84906 | 5.3 MEDIUM | Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transa |
| CVE-2026-86475 | 5.3 MEDIUM | Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appo |
| CVE-2026-19857 | 4.8 MEDIUM | Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Cu |
| CVE-2026-76552 | WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Impo | |
| CVE-2026-84907 | Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoi | |
| CVE-2026-76555 | WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File | |
| CVE-2026-76557 | WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options | |
| CVE-2026-76551 | WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function | |
| CVE-2026-74926 | MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via | |
| CVE-2026-76553 | WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template P | |
| CVE-2026-78472 | Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter | |
| CVE-2026-82124 | Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Con | |
| CVE-2026-77702 | Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token | |
| CVE-2026-84829 | Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter | |
| CVE-2026-84905 | Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation | |
| CVE-2026-84088 | Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget | |
| CVE-2026-82126 | Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content D | |
| CVE-2026-82125 | Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Con | |
| CVE-2026-76550 | WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Visualizer
-
CVE-2026-86782
Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modifi -
CVE-2026-86779
Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion v -
CVE-2026-19726
Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configura -
CVE-2026-14939
Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ -
CVE-2026-65526
WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnera
Same vendor: Unknown
-
CVE-2026-84091
SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthentica -
CVE-2026-90950
Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCH -
CVE-2026-87978
Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment By -
CVE-2026-87848
MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Pos -
CVE-2026-87071
Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Inje
V. Comments for CVE-2026-86784
No comments yet