Graphina – Charts and Graphs For Elementor <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tree Chart Widget Settings
- ID
- WPSEC-2026-2541
- Plugin
- Graphina – Charts and Graphs For Elementor (graphina-elementor-charts-and-graphs)
- Affected
- from 3.1.0 before 3.1.14
- Remediation
- Update to 3.1.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Graphina – Charts and Graphs For Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tree Chart widget settings (such as node names, categories and chart options) in versions 3.1.0 up to, and including, 3.1.13. The cause is insufficient input sanitization and output escaping: the chart options and tree data are JSON-encoded with wp_json_encode() and printed into single-quoted HTML data attributes without attribute escaping, so a single quote in a setting value ends the attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2541/
- https://plugins.svn.wordpress.org/graphina-elementor-charts-and-graphs/tags/3.1.14/
- https://wordpress.org/plugins/graphina-elementor-charts-and-graphs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS