chrisy TFO Graphviz Plugin tfo-graphviz-admin.php admin_page cross site scripting

published 2024-03-31 2 y ago modified 2026-06-17 4 mo ago also EUVD-2015-1141

cvss: 3.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.

Patch / fix

links 2

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-04-01)

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA	3.0	3.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

chrisy TFO Graphviz Plugin

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /wp-plugins/tfo-graphviz/commit/594c953a345f79e26003772093b0caafc14b92c2
patch
github.com /wp-plugins/tfo-graphviz/releases/tag/1.10
patch
vuldb.com /?id.258620
vdb-entry, technical-description
vuldb.com /?ctiid.258620
signature, permissions-required

Sources

CVE List CVE-2015-10131
NVD CVE-2015-10131

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary