CVE Vulnerability

CVE-2019-16931

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpvulndb.com/vulnerabilities/9893 Exploit Third Party Advisory
https://wordpress.org/plugins/visualizer/#developers Product Release Notes
https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:themeisle:visualizer:*:*:*:*:*:wordpress:*:*
Information

Published : 2019-10-03 07:15

Updated : 2019-10-09 07:50

NVD link : CVE-2019-16931

Mitre link : CVE-2019-16931

Products Affected
No products.
CWE
CWE-79