CVE-2022-46848: medium-severity vulnerability in Themeisle Visualizer: Tables and Charts…
WordPress Visualizer Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The WordPress Visualizer plugin version 3.9.1 and earlier allows authenticated users with contributor privileges to inject malicious scripts that get stored and executed in other users' browsers. This can compromise site security and user data.
Authenticated Stored XSS vulnerability in Visualizer plugin affecting versions ≤3.9.1, exploitable by users with contributor-level permissions or higher. Malicious script payloads are persisted in the database and executed client-side when accessed by other users, potentially leading to session hijacking, credential theft, or privilege escalation.
In the same product, most dangerous first.