{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agraphinacharts_and_graphs_for_elementor/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:graphina:charts_and_graphs_for_elementor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-110291"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Graphina – Charts and Graphs For Elementor (\u003c= 3.1.13)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","xss","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Graphina"],"content_html":"\u003cp\u003eThe Graphina - Charts and Graphs For Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions 3.1.13 and earlier. The flaw resides in the handling of the 'iq_tree_chart_node_font_family' parameter and other text controls serialized into 'chart_data['settings']'. Insufficient input sanitization allows malicious payloads to persist in the database. Elementor's 'Utils::kses_post_deep()' function fails to sanitize these inputs because the payloads can be crafted to avoid disallowed HTML tags while including event handlers.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject malicious scripts into WordPress pages. These scripts execute in the browser of any user who accesses the compromised page, potentially leading to unauthorized actions, session hijacking, or credential theft.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Graphina - Charts and Graphs For Elementor plugin to the version containing the security fix (if available) or disable the plugin if no patch is available.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to block requests containing suspicious event-handler attributes (e.g., 'onmouseover', 'onerror') within POST parameters targeted at the WordPress REST API or administrative endpoints.\u003c/li\u003e\n\u003cli\u003eAudit existing chart data records for injected JavaScript payloads in the 'settings' column.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T11:05:21Z","date_published":"2026-11-06T11:05:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-graphina-xss/","summary":"The Graphina - Charts and Graphs For Elementor WordPress plugin is vulnerable to stored cross-site scripting due to insufficient input sanitization of chart settings, allowing unauthenticated attackers to execute arbitrary web scripts.","title":"Graphina - Charts and Graphs For Elementor: Stored Cross-Site Scripting (CVE-2026-110291)","url":"https://feed.craftedsignal.io/briefs/2026-11-graphina-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:graphina:charts_and_graphs_for_elementor:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}