CVE Catalog
CVE-2026-24573
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.17%
6th percentile - higher than 6% of all known CVEs
Summary
The WordPress plugin Visualizer before version 4.0.0 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker can inject a malicious script that executes every time the page is viewed, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Update the Visualizer plugin to version 4.0.0 or later. Apply proper input filtering and encoding.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Stored XSS. This issue affects Visualizer: from n/a before 4.0.0.