WordPress Visualizer插件存储型XSS漏洞(CVE-2026-15653)分析

漏洞概述 漏洞名称: Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter CVE ID: CVE-2026-15653 CVSS评分: 6.4 (Medium) 发布日期: July 23, 2026 最后更新日期: July 24, 2026 研究人员: Wordfence PRISM - Wordfence 影响范围 软件类型: Plugin 软件名称: Visualizer – Tables & Charts Manager with Built-in AI Generator 受影响版本: <= 4.0.5 修复版本: 4.0.6 修复方案 修复建议: 更新到版本 4.0.6 或更新的补丁版本。 漏洞描述 漏洞类型: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) 漏洞详情: The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 参考链接 Learn more about Cross-Site Scripting vulnerabilities and how to prevent them plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org 分享选项 Facebook Twitter LinkedIn Email 其他信息 免责声明: 该记录包含受版权保护的材料。 版权声明: Copyright 2012-2026 Defiant Inc. MITRE Corporation: Copyright 1999-2026 The MITRE Corporation 近期漏洞 Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/chart/type/ REST Endpoint Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPage() and uploadData() Functions Visualizer: Tables and Charts Manager for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File PHPSpreadsheet Library < 2.3.0 - XXE Injection Visualizer <= 3.11.1 - Authenticated (Subscriber+) SQL Injection Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution Visualizer <= 3.10.5 - Reflected Cross-Site Scripting Themelife SDK <= Various Versions - Missing Authorization 更多信息 查看此软件包中的更多漏洞: VIEW MORE VULNERABILITIES IN THIS SOFTWARE PACKAGE 联系方式 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. 服务条款 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Twitter Facebook Instagram YouTube 产品与服务 Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form 订阅更新 Sign up for news and updates from our panel of experienced security professionals. 邮箱: you@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 版权信息 © 2012-2026 Defiant Inc. All Rights Reserved 其他 Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfence Wordfence Intelligence Wordfe

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

WordPress Visualizer插件存储型XSS漏洞(CVE-2026-15653)分析

目标达成感谢每一位支持者 — 我们达成了 100% 目标！