What is GHSA-424m-m5rp-gwfv?

GHSA-424m-m5rp-gwfv is a security advisory published by GitHub Security Advisories with Medium severity. The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data...

Which CVE IDs does GHSA-424m-m5rp-gwfv cover?

GHSA-424m-m5rp-gwfv covers the following CVE IDs: CVE-2026-86784. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-424m-m5rp-gwfv?

GHSA-424m-m5rp-gwfv has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-424m-m5rp-gwfvMediumCVSS 6.8

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-86784 →

📋 Description

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86784
https://wpscan.com/vulnerability/9ac2d380-62fd-4967-8697-40175ffdf1c7
https://github.com/advisories/GHSA-424m-m5rp-gwfv