WP-GraphViz

WP-GraphViz has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for WP-GraphViz has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Peter Thaleikis. WP-GraphViz is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all WP-GraphViz vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-58870

WP-GraphViz <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv1.5.1

WP-GraphViz

Jan DeBAAT

Author

Jan DeBAAT

4.0(3)
80/100
Last Updated
2023-07-23 (3y ago)
Active Installs
40+
Downloads
3,948
Requires WP
5.0+
Requires PHP
0+
Tested up to
WP 6.2.11
Created
2013-08-29 (13y ago)

GraphViz is a powerful tool for visualising network and tree structures that connect objects. This WordPress plugin provides a shortcode mechanism to create GraphViz graphics within blogs, using the shortcode mechanism. It’s working is based on the viz.js code as provided by Mike Daines: https://github.com/mdaines/viz.js Special thanks goes to chrisy as author of TFO Graphviz, e.g. for providing the inspiration for this readme: https://wordpress.org/plugins/tfo-graphviz/ How to use WP GraphViz The shortcode syntax is: [wp_graphviz <options>] <DOT code> [/wp_graphviz] Where <options> is anything from this list. All are entirely optional: id="<id>" Provides the identifier used to link the generated image to an image map. If you use the simple option then it also provides the name of the generated DOT graph container (since GraphViz uses this to generate the image map). If not given then an identifier is generated with the form wp_graphviz_N where N is an integer that starts at one when the plugin is loaded and is incremented with use. output="<png|gif|jpg|svg>" Indicates the desired image format. Defaults to png. simple="yes|no" The simple option provides a very basic DOT wrapper around your code such that the following is possible: [wp_graphviz simple="yes"] a -> b -> c; [/wp_graphviz] The generated code would look like: digraph wp_graphviz_1 { a -> b -> c; } See the id option for a description of where the name of the digraph comes from. simple defaults to no. title="<title>" Indicates the title of the image. This is used in the alt and title attributes of the image reference. This defaults to an empty string. Note that image maps may indicate a title string which will appear in tool-tips.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C