Description

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node_font_family (and any text control serialized into chart_data['settings'])' parameter in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Elementor's Utils::kses_post_deep() does not strip the attack payload on save because the payload contains no disallowed HTML tags — only a single quote and an event-handler fragment — allowing the malicious value to survive persistence.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-06T09:16:59.833Z",
  "pubdate": "2026-11-06T09:16:59.833Z",
  "executiveSummary": "The Graphina – Charts and Graphs For Elementor plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.1.13.\nThis vulnerability originates from improper input sanitization and output escaping mechanisms within the 'iq_tree_chart_node_font_family' parameter and other text controls serialized into 'chart_data['settings']'.\nAn unauthenticated attacker can inject arbitrary JavaScript payloads into chart configurations, which are subsequently rendered in the browser of any user viewing the affected page.\nThe security risk is critical, as it permits unauthorized script execution within the context of the victim's session, potentially leading to session hijacking, administrative action spoofing, or unauthorized redirection.\nExploitation does not require prior authentication, making the attack surface significantly broad for exposed WordPress installations.\nThe existing sanitization routines, specifically Elementor's Utils::kses_post_deep(), fail to neutralize the threat because the malicious payload utilizes event-handler fragments rather than disallowed HTML tags, allowing the injection to persist in the database.",
  "technicalDetails": "The vulnerability resides in the way the Graphina plugin processes and saves configuration data for chart nodes. Specifically, the 'iq_tree_chart_node_font_family' parameter and additional fields within the 'chart_data['settings']' array undergo insufficient validation before being committed to the WordPress database.\nThe root cause is a failure in the application's sanitization layer to recognize event-handler-based XSS vectors. While Elementor's Utils::kses_post_deep() is employed, it focuses primarily on stripping prohibited HTML tags. Because an attacker can construct a payload consisting of a single quote to break out of an attribute context followed by an event-handler fragment (e.g., ' onmouseover=alert(1)'), the sanitization logic identifies the input as benign and permits it to pass through to the database.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious JSON-encoded payload intended for the 'chart_data' settings object. Second, the attacker submits this payload to the endpoint responsible for saving chart configurations. Third, the backend server processes the request, failing to sanitize the event-handler injection. Finally, the malicious script is stored in the WordPress database.\nUpon rendering, the plugin retrieves the stored settings and injects the malicious string directly into the frontend HTML templates. When a victim views the affected page, the browser interprets the injected event-handler as valid DOM attributes, triggering the execution of the arbitrary JavaScript within the origin of the WordPress site.\nThis Stored XSS vector is particularly potent as it does not rely on reflected parameters but rather persists until the configuration is manually purged from the database. The post-exploitation impact includes the ability to exfiltrate sensitive cookies, perform actions on behalf of authenticated administrators, or alter site content by injecting dynamic DOM elements. Given the lack of authentication requirements, an attacker can impact any user viewing public-facing pages where the vulnerable chart component is rendered, facilitating large-scale client-side attacks."
}