CVE-2026-15653: WordPress Visualizer Plugin XSS Vulnerability

CVE-2026-15653 Overview

CVE-2026-15653 is a stored Cross-Site Scripting (XSS) vulnerability in the Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress. The flaw affects all plugin versions up to and including 4.0.5. It stems from insufficient input sanitization and output escaping on the backend-title parameter. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. The injected payload executes in the browser of any user who views an affected page. The issue is tracked as CWE-79.

Critical Impact
Authenticated contributors can store persistent JavaScript that executes in every visitor's session, enabling session theft, forced actions, and privilege escalation against administrators.

Affected Products

Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress
All versions up to and including 4.0.5
WordPress sites that grant contributor-level or higher access to untrusted users

Discovery Timeline

2026-07-24 - CVE-2026-15653 published to the National Vulnerability Database
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-15653

Vulnerability Analysis

The vulnerability resides in how the Visualizer plugin handles the backend-title parameter when rendering chart data pages. User-supplied input is stored in the database and later reflected into HTML output without adequate escaping. Because the payload persists server-side, every subsequent page render triggers execution in the viewer's browser context.

The attack requires an authenticated account with contributor privileges or higher, which lowers the barrier on multi-author WordPress sites. Successful exploitation runs attacker-controlled JavaScript under the origin of the vulnerable site. This allows theft of authentication cookies, forced administrative actions via CSRF-in-XSS chains, and defacement.

The scope-changed CVSS metric reflects that a low-privileged contributor can impact higher-privileged administrators and site visitors. Confidentiality and integrity are affected at a low level, while availability is unaffected.

Root Cause

The underlying defect is missing or incomplete sanitization of the backend-title input, combined with unescaped output rendering. The vulnerable rendering paths are visible in the plugin source at Visualizer Module/Chart.php line 553, Module/Chart.php line 826, and Render/Page/Data.php line 96. The plugin fails to apply WordPress helpers such as sanitize_text_field() on input and esc_attr() or esc_html() on output.

Attack Vector

An attacker authenticates to the target WordPress site with a contributor-or-higher account. The attacker submits a chart or table containing a malicious payload in the backend-title field. When an administrator or visitor loads a page that renders the stored value, the payload executes in their browser. The Wordfence advisory documents the exploitation preconditions. No verified public exploit code is provided; see the vendor changeset for the fix details.

Detection Methods for CVE-2026-15653

Indicators of Compromise

Chart or table records in the WordPress database containing <script>, onerror=, onload=, or javascript: substrings in the backend-title field
Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting Visualizer-rendered pages
New administrator accounts or role changes created shortly after a contributor account submitted chart content
Modified wp_options or theme files following administrator sessions on pages containing Visualizer charts

Detection Strategies

Query the WordPress database for Visualizer post meta entries and inspect backend-title values for HTML or JavaScript syntax
Deploy web application firewall rules that flag POST requests to Visualizer AJAX endpoints containing script tags or event-handler attributes
Review WordPress audit logs for contributor accounts creating or editing chart posts, then correlate with subsequent administrator visits

Monitoring Recommendations

Enable a Content Security Policy in report-only mode to identify inline script execution originating from plugin-rendered pages
Forward WordPress access and application logs to a centralized SIEM and alert on script-like payloads in backend-title parameters
Track privilege escalation events and session anomalies for administrator accounts that interact with contributor-authored content

How to Mitigate CVE-2026-15653

Immediate Actions Required

Update the Visualizer plugin to a version later than 4.0.5 as soon as the vendor releases a patched build
Audit all contributor, author, and editor accounts and remove any that are inactive or unrecognized
Purge or sanitize existing Visualizer chart entries containing suspicious HTML or JavaScript in the backend-title field
Rotate administrator passwords and invalidate active sessions if contributor-authored chart pages were viewed by administrators

Patch Information

The vendor addressed the issue in a commit visible in the WordPress plugin changeset 3619025. Site operators should upgrade to the fixed release through the WordPress admin plugin updater. Verify the installed version via wp plugin get visualizer --field=version after applying updates.

Workarounds

Temporarily deactivate the Visualizer plugin until a patched release is installed
Restrict chart and table creation to trusted editor-or-administrator accounts by removing the capability from contributor and author roles
Deploy a WAF rule to block requests to Visualizer endpoints that contain HTML tags or JavaScript event handlers in the backend-title parameter

bash

# Example WAF condition (ModSecurity-style) to block script payloads in backend-title
SecRule ARGS:backend-title "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026156530,phase:2,deny,status:403,log,msg:'CVE-2026-15653 Visualizer XSS attempt'"