CVE-2026-86784 is a stored Cross-Site Scripting vulnerability in the Visualizer WordPress plugin prior to version 4.0.8. The flaw arises because the plugin does not properly sanitize or escape the JSON data source configuration of charts before outputting it in the chart editor interface. This allows users with Contributor role or above to embed arbitrary JavaScript code that executes in the context of any higher-privileged user who views the chart, potentially leading to session hijacking or other browser-based attacks.

An attacker with Contributor or higher privileges can inject malicious JavaScript into chart configurations. When an administrator or other higher-privileged user accesses the chart editor, the injected script executes in their browser context. This could lead to unauthorized actions performed with the victim's privileges, including theft of credentials or site control. The vulnerability requires the attacker to have at least Contributor access, limiting the initial attack vector to authenticated users with some level of trust.

Upgrade the Visualizer plugin to version 4.0.8 or later, where this vulnerability is fixed. Since the vulnerability is addressed in the updated version, applying this official fix is the recommended remediation. No other vendor advisory or patch information is provided, so check the plugin's official release notes for confirmation.