The Graphina – Elementor Charts and Graphs plugin for WordPress contains a stored cross‑site scripting flaw (CWE‑79) that allows authenticated users with Contributor‑level or higher to inject arbitrary JavaScript into chart widget configuration data. Because the plugin fails to properly sanitize or escape data attributes, any script stored in a widget is executed whenever a user views a page containing that widget, resulting in a stored XSS vulnerability.

Affected versions are all releases of the plugin up to and including 3.1.8. The problem exists in the Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart and Advance Data Table widgets, which are part of the iqonicdesign Graphina – Charts and Graphs For Elementor package installed on WordPress sites that use Elementor for page building.

The CVSS score is 6.4, indicating a moderate exploitation risk. The EPSS score is less than 1%, suggesting that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Attacks require an authenticated Contributor‑level account and target sites where chart widgets are displayed to other users. Because the flaw is stored, compromised data remains on the site until the plugin is upgraded or the offending widget content is removed.