CVE-2019-16931

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.

• CWE-79

• https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrfExploit, Third Party Advisory
• https://wordpress.org/plugins/visualizer/#developersProduct, Release Notes
• https://wpvulndb.com/vulnerabilities/9893Exploit, Third Party Advisory
• https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrfExploit, Third Party Advisory
• https://wordpress.org/plugins/visualizer/#developersProduct, Release Notes
• https://wpvulndb.com/vulnerabilities/9893Exploit, Third Party Advisory

Published

Oct 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16926Flower 0.9.3 has XSS via a crafted worker name. NOTE: The pr…6.1
• CVE-2019-16927Xpdf 4.01.01 has an out-of-bounds write in the vertProfile p…5.5
• CVE-2019-16928Exim 4.92 through 4.92.2 allows remote code execution, a dif…9.8
• CVE-2019-16929Auth0 auth0.net before 6.5.4 has Incorrect Access Control be…7.5
• CVE-2019-1693A vulnerability in the WebVPN service of Cisco Adaptive Secu…6.5
• CVE-2019-16930Zcashd in Zcash before 2.0.7-3 allows discovery of the IP ad…5.3
• CVE-2019-16932A blind SSRF vulnerability exists in the Visualizer plugin b…10
• CVE-2019-16935The documentation XML-RPC server in Python through 2.7.16, 3…6.1
• CVE-2019-1694A vulnerability in the TCP processing engine of Cisco Adapti…8.6
• CVE-2019-16941NSA Ghidra through 9.0.4, when experimental mode is enabled,…9.8
• CVE-2019-16942A Polymorphic Typing issue was discovered in FasterXML jacks…9.8
• CVE-2019-16943A Polymorphic Typing issue was discovered in FasterXML jacks…9.8