Stored Cross-Site Scripting Vulnerability in Graphina Plugin for Elementor by WordPress
CVE-2026-110291

7.2HIGH

Key Information:

Vendor

WordPress
Status
Graphina – Charts And Graphs For Elementor
Vendor
CVE Published:
6 November 2026

What is CVE-2026-110291?

The Graphina – Charts and Graphs For Elementor plugin for WordPress has a vulnerability that allows for stored cross-site scripting through the 'iq_tree_chart_node_font_family' parameter. This occurs due to inadequate input sanitization and output escaping. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts, which execute when users access the compromised pages. The underlying issue is that Elementor's Utils::kses_post_deep() fails to remove harmful payloads during saves, as these payloads do not contain disallowed HTML tags, thereby permitting the assault to persist.

Affected Version(s)

Graphina – Charts and Graphs For Elementor 0 <= 3.1.13

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/graphina-eleme...
https://plugins.trac.wordpress.org/browser/graphina-eleme...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.