CVE-2026-110291 Details

A stored cross-site scripting vulnerability has been identified in the Graphina – Charts and Graphs For Elementor plugin for WordPress, affecting all versions through 3.1.13. The vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute when a user accesses the compromised page. The issue is linked to the 'iq_tree_chart_node_font_family' parameter, as well as any text control serialized into 'chart_data[settings]'. Elementor's Utils::kses_post_deep() fails to remove the injected payload upon saving, as the payload only includes a single quote and an event-handler fragment—elements not considered disallowed HTML tags—permitting the malicious content to persist.

Users are advised to update the Graphina – Charts and Graphs For Elementor plugin to version 3.1.14 or a newer patched version.