Stored Cross-Site Scripting Vulnerability in Graphina – Elementor Charts and Graphs Plugin for WordPress

CVE-2025-11820

What is CVE-2025-11820?

The Graphina – Elementor Charts and Graphs plugin for WordPress has a vulnerability allowing authenticated users with Contributor-level access or higher to perform Stored Cross-Site Scripting attacks. This is due to insufficient input sanitization and output escaping on data attributes across multiple chart widgets such as Area Chart, Line Chart, and Pie Chart in versions up to and including 3.1.8. Attackers can inject arbitrary web scripts into the pages, leading to potential exploitation whenever users access those pages.

References