Graphina - Charts and Graphs For Elementor: Stored Cross-Site Scripting (CVE-2026-110291)

The Graphina - Charts and Graphs For Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions 3.1.13 and earlier. The flaw resides in the handling of the 'iq_tree_chart_node_font_family' parameter and other text controls serialized into 'chart_data['settings']'. Insufficient input sanitization allows malicious payloads to persist in the database. Elementor's 'Utils::kses_post_deep()' function fails to sanitize these inputs because the payloads can be crafted to avoid disallowed HTML tags while including event handlers.

Impact

Successful exploitation allows unauthenticated attackers to inject malicious scripts into WordPress pages. These scripts execute in the browser of any user who accesses the compromised page, potentially leading to unauthorized actions, session hijacking, or credential theft.

Recommendation

• Update the Graphina - Charts and Graphs For Elementor plugin to the version containing the security fix (if available) or disable the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) to block requests containing suspicious event-handler attributes (e.g., 'onmouseover', 'onerror') within POST parameters targeted at the WordPress REST API or administrative endpoints.
• Audit existing chart data records for injected JavaScript payloads in the 'settings' column.