WordPress Visualizer Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS)

The WordPress Visualizer plugin version 3.9.1 and earlier allows authenticated users with contributor privileges to inject malicious scripts that get stored and executed in other users' browsers. This can compromise site security and user data.

Authenticated Stored XSS vulnerability in Visualizer plugin affecting versions ≤3.9.1, exploitable by users with contributor-level permissions or higher. Malicious script payloads are persisted in the database and executed client-side when accessed by other users, potentially leading to session hijacking, credential theft, or privilege escalation.