# Graphina – Charts and Graphs For Elementor <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tree Chart Widget Settings

- **ID:** WPSEC-2026-2541
- **Plugin:** Graphina – Charts and Graphs For Elementor (`graphina-elementor-charts-and-graphs`), https://wordpress.org/plugins/graphina-elementor-charts-and-graphs/
- **Affected versions:** from 3.1.0 before 3.1.14
- **Fixed in:** 3.1.14 (Update to 3.1.14 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/graphina-elementor-charts-and-graphs
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2541/

## Description

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tree Chart widget settings (such as node names, categories and chart options) in versions 3.1.0 up to, and including, 3.1.13. The cause is insufficient input sanitization and output escaping: the chart options and tree data are JSON-encoded with wp_json_encode() and printed into single-quoted HTML data attributes without attribute escaping, so a single quote in a setting value ends the attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2541/
- https://plugins.svn.wordpress.org/graphina-elementor-charts-and-graphs/tags/3.1.14/
- https://wordpress.org/plugins/graphina-elementor-charts-and-graphs/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2541/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.