{
 "id": "WPSEC-2026-2541",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2541/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2541/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2541/index.md",
 "title": "Graphina – Charts and Graphs For Elementor <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tree Chart Widget Settings",
 "description": "The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tree Chart widget settings (such as node names, categories and chart options) in versions 3.1.0 up to, and including, 3.1.13. The cause is insufficient input sanitization and output escaping: the chart options and tree data are JSON-encoded with wp_json_encode() and printed into single-quoted HTML data attributes without attribute escaping, so a single quote in a setting value ends the attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "graphina-elementor-charts-and-graphs",
  "name": "Graphina – Charts and Graphs For Elementor",
  "full_name": "Graphina – Charts and Graphs For Elementor",
  "wordpress_org": "https://wordpress.org/plugins/graphina-elementor-charts-and-graphs/",
  "advisories_url": "https://wpsec.com/vuln/plugin/graphina-elementor-charts-and-graphs/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/graphina-elementor-charts-and-graphs"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1.0",
    "from_inclusive": true,
    "to": "3.1.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1.0 before 3.1.14"
  ]
 },
 "introduced_in": "3.1.0",
 "fixed_in": "3.1.14",
 "remediation": "Update to 3.1.14 or later.",
 "fix_released": "2026-11-04T06:30:48+00:00",
 "published": "2026-11-05T06:43:38+00:00",
 "updated": "2026-11-04T13:58:00.407143+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2541/",
  "https://plugins.svn.wordpress.org/graphina-elementor-charts-and-graphs/tags/3.1.14/",
  "https://wordpress.org/plugins/graphina-elementor-charts-and-graphs/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/graphina-elementor-charts-and-graphs",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}