CVE-2019-16931

EPSS 3.3%

Vexday Risk Score

18Baixo

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 3.3%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

03 out 2019Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.

Produtos afetados

n/a · n/a

Referências

https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf https://wordpress.org/plugins/visualizer/#developers https://wpvulndb.com/vulnerabilities/9893