Unknown Visualizer vulnerabilities

5 CVEs affecting Unknown Visualizer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86784, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-86784, published 2026-09-16. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor…
CVE-2026-14939, published 2026-08-04. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to…
CVE-2026-19726, published 2026-08-16. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration…
CVE-2026-86782, published 2026-09-11. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite…
CVE-2026-86779, published 2026-09-11. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing…