WordPress security by component
Visualizer
Plugin description
Visualizer is a WordPress component with 13 published CVE records in this archive. The latest tracked vulnerability was published Jul 23, 2026; the highest CVE/CNA score is 10.
Plugin slug:
visualizerLatest vulnerability
CVE-2026-65526: Visualizer: SQL injection
Visualizer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.0.6.
| Safe version |
|
||
|---|---|---|---|
| Jul 23, 2026 |
CVE-2026-65526
Visualizer: SQL injection
Visualizer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 4.0.6.
|
> 4.0.6 |
CVE8.5
NVDPending
|
| Jul 01, 2026 |
CVE-2026-13468
Visualizer – Tables & Charts Manager with Built-in AI Generator: A security weakness
Visualizer – Tables & Charts Manager with Built-in AI Generator is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.0.3.
|
> 4.0.3 |
CVE7.5
NVDPending
|
| May 28, 2026 |
CVE-2026-8689
Visualizer: Tables and Charts Manager for WordPress: A security weakness
Visualizer: Tables and Charts Manager for WordPress is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.11.14.
|
> 3.11.14 |
CVE4.3
NVDPending
|
| May 20, 2026 |
CVE-2026-24573
Visualizer: Cross-site scripting
Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a to < 4.0.0.
|
4.0.0 |
CVE6.5
NVDPending
|
| Dec 02, 2025 |
CVE-2025-12483
Visualizer: Tables and Charts Manager for: SQL injection
Visualizer: Tables and Charts Manager for is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Jun 08, 2024 |
CVE-2024-35736
Visualizer: SQL injection
Visualizer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.5
NVD8.8
|
| May 16, 2024 |
CVE-2024-3750
Visualizer: Tables and Charts Manager for: Privilege escalation or authentication bypass
Visualizer: Tables and Charts Manager for is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Mar 17, 2024 |
CVE-2024-27958
Visualizer: Cross-site scripting
Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|
| May 03, 2023 |
CVE-2023-23708
Visualizer: Cross-site scripting
Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Mar 28, 2023 |
CVE-2022-46848
Visualizer: Cross-site scripting
Visualizer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Jul 18, 2022 |
CVE-2022-2444
Visualizer: Tables and Charts Manager for: Code execution
Visualizer: Tables and Charts Manager for is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Oct 03, 2019 |
CVE-2019-16931
Visualizer: Cross-site scripting
Visualizer is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Sep 30, 2019 |
CVE-2019-16932
Visualizer: Server-side request forgery
Visualizer is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.
|
See mitigation notes |
CVE10.0
NVD10.0
|