CVE-2026-86784

MediumCVSS 6.8/10Last modified Sep 17, 2026

Description

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-867855.3The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allCVE-2026-867865.3The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unCVE-2026-867877.2The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled CVE-2026-867886.8The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in sCVE-2026-867895.3The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certCVE-2026-86797.5The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is dueCVE-2026-867906.8The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortCVE-2026-867915.3The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recoCVE-2026-867928.8Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field inCVE-2026-867939.8SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpicCVE-2026-867948.8The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, andCVE-2026-867955.3The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthen