Graphina in version 3.1.3 and earlier stores user‑supplied chart attributes without sanitization, allowing a logged‑in user with contributor or higher role to inject arbitrary JavaScript that persists in the chart configuration. When any site visitor loads a page containing the compromised chart, the injected script will execute in the visitor’s browser, potentially allowing credential theft, session hijacking or other malicious actions. The flaw is a classic reflected input validation weakness classified as CWE‑79.

The vulnerability is present in the Graphina – Charts and Graphs For Elementor plugin developed by iqonicdesign, affecting all releases up to and including 3.1.3. No other vendors are listed as impacted.

The flaw carries a CVSS score of 6.4, indicating a medium severity, and has an EPSS score of < 1 %, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attacker must first authenticate with contributor or higher privileges to inject malicious input, but once a chart contains the payload, the compromised code executes for all users who view that page. Due to the requirement of an authenticated attacker and the need for human interaction to inject the payload, the overall risk remains moderate but non‑negligible for sites that rely heavily on this plugin.