CVE-2026-110291: Stored XSS in Graphina Plugin
A stored cross-site scripting (XSS) vulnerability, tracked as CVE-2026-110291, has been published for the Graphina – Charts and Graphs For Elementor plugin for WordPress. NVD lists a CVSS score of 7.2 (High).
The flaw affects all versions up to and including 3.1.13.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-110291 |
| CVSS Score | 7.2 (High) |
| Type | Stored Cross-Site Scripting (XSS) |
| Affected Product | Graphina – Charts and Graphs For Elementor |
| Affected Versions | 3.1.13 and earlier |
| Published | 2026-11-06 |
Technical Details
According to the NVD description, the plugin fails to sanitize input and escape output for the iq_tree_chart_node_font_family parameter. The description also states that any text control serialized into chart_data['settings'] is affected.
Because the payload is stored with the chart data, the script runs each time a page that renders the affected chart is loaded. Visitors and administrators who view that page are exposed.
The full NVD description was truncated in our source feed. The exact privilege level required to inject the payload was not confirmed, so check the NVD entry for the CVSS vector.
Impact
A successful attack could allow an attacker to:
- Run arbitrary JavaScript in the browsers of visitors and logged-in users
- Hijack administrator sessions or perform actions as an authenticated user
- Redirect visitors or inject malicious content into pages
Remediation
- Update Graphina to a release newer than 3.1.13 once the vendor publishes a fixed version. A fixed version was not confirmed at publication time.
- Audit existing charts for unexpected script content in text and font-family settings.
- Limit contributor access. Restrict who can create or edit Elementor content until the plugin is patched.
- Consider disabling the plugin if it is not essential and no fix is available.
- Use a WAF with XSS rules as a compensating control.