The Visualizer plugin contains a stored cross‑site scripting flaw where user input is not properly neutralized during page generation. An attacker who can inject content into the plugin’s storage area can place malicious JavaScript that will run in the browsers of anyone who views the affected pages. This can allow session hijacking, defacement, and the execution of arbitrary client‑side code.

The weakness exists in Themeisle Visualizer, affecting all versions prior to 4.0.0. Sites that have installed any of those earlier releases and have the plugin enabled are vulnerable.

The CVSS score of 6.5 classifies the flaw as moderate severity. With no EPSS score available, the exploit likelihood is unknown. The vulnerability is not listed in CISA’s KEV. Attackers can exploit the stored XSS by submitting malicious script via the plugin’s input interface, which is later rendered without sanitization for all visitor browsers. Successful exploitation could lead to user‑session compromise or defacement, but requires the attacker’s content to be accepted and stored by the plugin.