The Graphina – Charts and Graphs for Elementor plugin contains a stored cross‑site scripting flaw that allows an attacker to persistently inject arbitrary JavaScript via the iq_tree_chart_node_font_family control or any text control serialized into chart_data['settings']. Because input sanitization fails and output escaping is incomplete, the malicious content survives in the database and executes when any user views the affected page, enabling the attacker to steal credentials, deface content, or perform other malicious actions. This is a classic CWE‑79 stored cross‑site scripting vulnerability.

All WordPress sites running the Graphina plugin through version 3.1.13 are vulnerable. Attackers are not required to authenticate to exploit the issue; they can create or modify chart settings exposed to any site visitor. Upgrading to 3.1.14 or later resolves the problem.

The CVSS score of 7.2 classifies the vulnerability as high severity. The vulnerability is not listed in CISA’s KEV catalog, but because it is unauthenticated and permits arbitrary script execution, organizations should treat it as a priority issue and remediate promptly. Attackers could chain this flaw with other vulnerabilities, amplifying the overall risk. It exemplifies a CWE‑79 stored cross‑site scripting flaw, enabling persistent code execution with potential data exfiltration.