Visualizer: Tables and Charts Manager for

Visualizer is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 4.0.7. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer before 4.0.6 accepts a Contributor-supplied URL without excluding unsafe address ranges before fetching it from the WordPress server. The fetched response is returned to the caller, allowing a Contributor to query link-local cloud metadata endpoints and retrieve instance metadata, including IAM credentials when the hosting environment exposes them. The public advisory does not disclose the endpoint, URL parameter, request function or supported protocols.

Visualizer through 4.0.5 lets a Contributor submit an attacker-controlled backend-title value through the authenticated /wp-admin/admin-ajax.php visualizer-edit-chart action while saving chart data and settings. _handleDataAndSettingsPage() stores the POST settings in the chart's Visualizer_Plugin::CF_SETTINGS metadata without sanitizing that field, and Visualizer_Render_Page_Data renders backend-title into the chart editor input without attribute escaping. The stored payload executes when a user opens the affected chart's data editor.

Visualizer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.0.1. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer – Tables & Charts Manager with Built-in AI Generator is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.0.3. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer: Tables and Charts Manager for WordPress is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.11.14. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a to < 4.0.0. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer: Tables and Charts Manager for is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.

Visualizer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer: Tables and Charts Manager for is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer: Tables and Charts Manager for is affected by code execution. Exploitation requires an authenticated contributor account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Visualizer is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Visualizer is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.