{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1065", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-05T18:14:04.973Z", "datePublished": "2025-02-19T05:22:52.516Z", "dateUpdated": "2026-04-08T16:37:29.126Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:29.126Z"}, "affected": [{"vendor": "themeisle", "product": "Visualizer: Tables and Charts Manager for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.11.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17c1de7b-5178-4fbe-a515-169de4323ae7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3240066/visualizer"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-02-05T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-18T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-19T14:55:12.631233Z", "id": "CVE-2025-1065", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T14:56:01.047Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1065", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-19T14:55:12.631233Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T14:55:09.897Z"}}], "cna": {"title": "Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "themeisle", "product": "Visualizer: Tables and Charts Manager for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.11.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-05T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-02-18T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17c1de7b-5178-4fbe-a515-169de4323ae7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3240066/visualizer"}], "descriptions": [{"lang": "en", "value": "The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:29.126Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1065", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:29.126Z", "dateReserved": "2025-02-05T18:14:04.973Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-19T05:22:52.516Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Visualizer: Tables and Charts Manager for WordPress para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de los datos de importaci\u00f3n del complemento desde la funci\u00f3n de archivo en todas las versiones hasta 3.11.8 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto hace posible a los atacantes autenticados, con acceso a nivel de contribuyente y superior, para inyectar Web scripts en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-1065", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-02-19T06:15:21.507", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3240066/visualizer"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17c1de7b-5178-4fbe-a515-169de4323ae7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:57:21.006889+00:00", "value": {"mitigation_remediation": ["Update Visualizer to the latest version (\u22653.11.9).", "If an update is unavailable, disable the Import Data From File feature or restrict it to administrators only.", "Revoke contributor or higher privileges from untrusted users and audit the site\u2019s role assignments to ensure only trusted users can import data."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerable product is Themeisle\u2019s Visualizer: Tables and Charts Manager for WordPress. All releases up to and including version 3.11.8 are affected. Users running these versions should verify the plugin version and apply an update if available.", "description_and_impact": "The Visualizer plugin contains a stored cross\u2011site scripting flaw that allows an authenticated attacker with contributor or higher level access to embed malicious scripts into imported data files. The plugin fails to properly sanitize and escape user supplied attributes, so the attacker can insert XSS payloads that are rendered when anyone views the affected page. This can lead to theft of user credentials, session hijacking, or site defacement. The weakness corresponds to CWE\u201179.", "risk_and_exploitability": "With a CVSS score of 6.4 the risk is moderate and the EPSS score of less than 1% indicates low exploitation likelihood in the current landscape. The vulnerability is not listed in the CISA KEV catalog. Attacking requires an authenticated contributor\u2011level account; once inside, the attacker can inject scripts that execute for any visitor to the polluted page, potentially impacting confidentiality and integrity of user data."}}}}, "created": "2026-04-22T18:00:05.483726+00:00", "updated": "2026-04-22T18:00:05.483736+00:00", "vendors": []}