CVE-2026-15653: Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15653?
The severity of CVE-2026-15653 is medium with a score of 6.4.
How do I fix CVE-2026-15653?
To fix CVE-2026-15653, update the Visualizer plugin to the latest version that addresses the stored cross-site scripting vulnerability.
What type of vulnerability is CVE-2026-15653?
CVE-2026-15653 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-15653?
All users of Visualizer Tables & Charts Manager with Built-in AI Generator for WordPress versions up to and including 4.0.5 are affected by CVE-2026-15653.
What can attackers do with CVE-2026-15653?
Attackers exploiting CVE-2026-15653 can inject malicious scripts via the 'backend-title' parameter, potentially affecting users with Contributor or higher privileges.