The Data Visualizer plugin for WordPress is vulnerable to Stored Cross‑Site Scripting because the plugin does not properly sanitize or escape the attributes supplied to its 'visualize' shortcode. When an authenticated user with contributor or higher privileges creates or edits a post containing the shortcode, arbitrary JavaScript can be stored in the database. Visitors who view the affected post will then execute the injected script, potentially allowing attackers to steal session cookies, inject malicious content, or redirect users.

Any WordPress site running subhransu‑sekhar Data Visualizer plugin version 1.1 or earlier is affected. The vulnerability applies to all standard installations of the plugin up to and including version 1.1.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% shows that exploitation is considered unlikely at present. The vulnerability requires authenticated access with at least contributor privileges, which is a common role on many WordPress sites. The attacker must first create a post or edit an existing one to embed malicious attributes in the shortcode; once inserted, any visitor to the page will be exposed. Because the attack vector is web‑based and confined to a logged‑in user, the likelihood of remote exploit is low, yet it can lead to significant user‑level impact.