CVE-2025-13961 is a stored cross-site scripting vulnerability in the Data Visualizer WordPress plugin by subhransu-sekhar. The issue exists in all versions up to and including 1.1, specifically in the 'visualize' shortcode, where user input is not properly sanitized or escaped before being output on web pages. This allows authenticated users with contributor or higher roles to inject arbitrary JavaScript code that executes in the context of other users viewing the injected content. The vulnerability has a CVSS v3.1 base score of 6.4, reflecting a network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages using the 'visualize' shortcode. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions such as session hijacking or data theft. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported.

No official patch or remediation is currently available for this vulnerability. Users of the Data Visualizer plugin should monitor the vendor's announcements for updates or fixes. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if possible to mitigate risk.