The Visualizer: Tables and Charts Manager for WordPress plugin contains a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2025-1065. This vulnerability exists due to improper neutralization of user-supplied input during web page generation, specifically in the Import Data From File feature. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that will be stored and executed in the context of users who access the compromised pages. This can lead to information disclosure or session hijacking. The vulnerability affects all plugin versions up to 3.11.8. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation allows authenticated users with contributor-level access or above to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of users. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor-level access to trusted users only and consider disabling or restricting use of the Import Data From File feature. Monitor official themeisle channels for updates regarding patches or mitigations.