Graphina Charts And Graphs For Elementor
Monthly
Stored Cross-Site Scripting in the Graphina - Charts and Graphs For Elementor WordPress plugin (all versions through 3.1.11) allows authenticated contributors to inject persistent malicious scripts via the 'iq_tree_tree_chart_template' widget setting. Because the scope changes (S:C), injected payloads execute in the browser context of any visitor who loads the affected page, enabling session hijacking, credential theft, or drive-by malware delivery. The vulnerability stems from insufficient sanitization of widget input and missing output escaping in the TreeChart rendering path, with specific vulnerable code identified by Wordfence at TreeChart.js:146, tree-chart.php:19, GraphinaFunction.php:1653, and GraphinaElementorControls.php:1446. No public exploit code or CISA KEV listing is confirmed at time of analysis.
Stored Cross-Site Scripting in the Graphina - Charts and Graphs For Elementor WordPress plugin (all versions through 3.1.11) allows authenticated contributors to inject persistent malicious scripts via the 'iq_tree_tree_chart_template' widget setting. Because the scope changes (S:C), injected payloads execute in the browser context of any visitor who loads the affected page, enabling session hijacking, credential theft, or drive-by malware delivery. The vulnerability stems from insufficient sanitization of widget input and missing output escaping in the TreeChart rendering path, with specific vulnerable code identified by Wordfence at TreeChart.js:146, tree-chart.php:19, GraphinaFunction.php:1653, and GraphinaElementorControls.php:1446. No public exploit code or CISA KEV listing is confirmed at time of analysis.