CVE-2025-11820: Graphina WordPress Plugin XSS Vulnerability

CVE-2025-11820 Overview

CVE-2025-11820 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Graphina – Elementor Charts and Graphs plugin for WordPress. All versions up to and including 3.1.8 fail to properly sanitize input and escape output on data attributes rendered by multiple chart widgets. Authenticated users with Contributor-level permissions or above can inject arbitrary JavaScript that executes when any visitor loads an affected page. The impacted widgets include Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and the Advance Data Table widget. The flaw is categorized under [CWE-79].

Critical Impact
Authenticated contributors can persist malicious scripts in chart widget attributes, enabling session hijacking, administrative account takeover, and arbitrary redirection of site visitors.

Affected Products

Graphina – Elementor Charts and Graphs plugin for WordPress, versions ≤ 3.1.8
WordPress sites running Elementor with the Graphina widgets enabled
Multi-author WordPress environments granting Contributor or higher roles to untrusted users

Discovery Timeline

2025-11-05 - CVE-2025-11820 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11820

Vulnerability Analysis

The vulnerability resides in how Graphina chart widgets render user-controlled configuration data into HTML data attributes. The plugin's client-side rendering logic in files such as GraphinaApexChartBase.js, AdvanceDataTable.js, AreaChart.js, and LineChart.js reads attribute values and reflects them into the DOM without adequate sanitization or escaping.

Because contributor-level accounts can author posts that embed Elementor widgets, an attacker can craft chart widget markup containing payloads inside the exposed data attributes. When any user (including administrators) subsequently loads the published page, the browser parses the injected markup and executes attacker-supplied JavaScript in the context of the site.

The scope is marked as changed, reflecting that the compromise crosses from the authenticated contributor's authored content into the browsers of unrelated users, including privileged ones.

Root Cause

The root cause is insufficient input sanitization and output escaping on data attributes consumed by the ApexCharts-based widgets. The plugin trusts widget configuration values and renders them directly into HTML markup where JavaScript can be executed through event handlers or script-containing attributes.

Attack Vector

An authenticated contributor edits a page in Elementor, adds one of the vulnerable chart widgets, and supplies malicious content in a widget field that maps to a reflected data attribute. After the content is saved and the page is viewed by another user, the injected script runs with that user's privileges. If an administrator views the page, the attacker can escalate by creating new administrator accounts, modifying plugins, or exfiltrating session cookies.

The vulnerability requires no user interaction beyond browsing the compromised page, and attacks can be delivered remotely. Technical details are documented in the Wordfence Vulnerability Report and the vulnerable rendering logic can be inspected in the GraphinaApexChartBase.js source.

Detection Methods for CVE-2025-11820

Indicators of Compromise

Chart widget data attributes containing HTML event handlers such as onerror, onload, or onmouseover
Pages authored by contributor-level accounts that embed Graphina widgets with unexpected <script> tags or encoded JavaScript payloads
Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting pages with Graphina widgets
Newly created administrator accounts or modified user roles following edits by low-privilege contributors

Detection Strategies

Audit the WordPress wp_posts table for Elementor data referencing Graphina widgets and inspect serialized configuration for script fragments
Enable WordPress audit logging to track post edits by contributor-level users and correlate with Graphina widget usage
Deploy a web application firewall rule set that flags suspicious characters in POST bodies submitted to Elementor save endpoints
Review browser Content Security Policy (CSP) violation reports for inline script execution on pages containing chart widgets

Monitoring Recommendations

Monitor the installed Graphina plugin version via wp plugin list and alert when sites remain on versions ≤ 3.1.8
Track administrative session anomalies, including unexpected privilege changes or new API keys issued after page views
Log and review all Elementor post revisions created by non-administrator users for widget attributes containing HTML-unsafe characters

How to Mitigate CVE-2025-11820

Immediate Actions Required

Update the Graphina – Elementor Charts and Graphs plugin to a version newer than 3.1.8 as soon as a patched release is available
Temporarily revoke publishing capabilities from untrusted contributor-level accounts until the plugin is updated
Audit recent posts and pages that use Graphina chart widgets for injected payloads and remove any suspicious content
Rotate administrator credentials and invalidate active sessions if contributor accounts are suspected of exploitation

Patch Information

The advisory covers all versions up to and including 3.1.8. Site owners should consult the Wordfence Vulnerability Report and the plugin's WordPress.org changelog for the fixed release and upgrade immediately once published.

Workarounds

Disable the Graphina plugin entirely until a patched version is installed
Restrict Elementor editing permissions so that only trusted editors and administrators can author pages containing chart widgets
Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to limit XSS impact
Apply WAF rules that filter HTML event handler attributes and <script> tags in requests to WordPress admin endpoints

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate graphina-elementor-charts-and-graphs

# Verify current installed version
wp plugin get graphina-elementor-charts-and-graphs --field=version

# Update once a fixed release is published
wp plugin update graphina-elementor-charts-and-graphs