Graphina Elementor Charts EUVD-2026-74543

Exploitation requires an authenticated WordPress user account with at minimum Contributor role (PR:L), which grants access to create or edit Elementor-powered pages containing Graphina widgets. The 'iq_tree_tree_chart_template' widget setting must be present and editable on the site - this requires both the Elementor page builder and the Graphina plugin to be active. No special server-side configuration is needed beyond the plugin being installed and a contributor account being available. Exploitation is limited by: (1) the PR:L requirement - guest/subscriber roles cannot edit widget settings; (2) Elementor must be installed alongside Graphina; (3) a victim must visit the injected page for the XSS payload to execute. Sites with open contributor registration or high author turnover face elevated risk.

The CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) accurately captures the key dynamics: low complexity, contributor-level authentication required (PR:L), scope change to victim browsers, and bounded C:L/I:L impact. The PR:L requirement is the primary mitigating factor - exploitation requires at minimum a WordPress contributor account, which limits opportunistic mass exploitation. However, on sites that allow open contributor registration or have many content authors, this barrier is low. No KEV listing or EPSS score is provided, so real-world exploitation frequency is unknown. The changeset fix (revision 3553477 in the WordPress plugin SVN) is publicly visible, which means attackers can diff the patch and reverse-engineer the exact payload, potentially lowering exploitation complexity for anyone with contributor access. The stored nature of the XSS means a single injection persistently affects all page visitors until the payload is removed, amplifying impact beyond a reflected variant.

An attacker with a contributor account on a target WordPress site edits or creates an Elementor page, inserts a Graphina tree chart widget, and sets the 'iq_tree_tree_chart_template' parameter to a crafted JavaScript payload. Once the page is published, every authenticated or unauthenticated visitor who loads that page executes the payload in their browser, enabling the attacker to steal session cookies, perform actions on behalf of administrators, or redirect users to malicious sites. The patch-visible fix at SVN changeset 3553477 could allow an attacker to construct a precise payload targeting the unsanitized parameter without additional reconnaissance.