CVE-2019-16931

MEDIUM NUCLEI

Visualizer < 3.3.0 - Unauthenticated Stored Cross-Site Scripting via Chart Update Endpoint

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-16931 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.

Nuclei Templates (1)

WordPress Visualizer <3.3.1 - Cross-Site Scripting
MEDIUMVERIFIEDby ritikchaddha

References (3)

Core 3
Core References
Product, Release Notes x_refsource_misc
https://wordpress.org/plugins/visualizer/#developers
Exploit, Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9893
Exploit, Third Party Advisory x_refsource_misc
https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf

Scores

CVSS v3 6.1
EPSS 0.0334
EPSS Percentile 87.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
themeisle/visualizer < 3.3.0
Published Oct 03, 2019
Tracked Since Feb 18, 2026