CVE-2026-13709: Graphina WordPress Plugin XSS Vulnerability

CVE-2026-13709 Overview

CVE-2026-13709 is a stored cross-site scripting (XSS) vulnerability in the Graphina – Charts and Graphs For Elementor plugin for WordPress. The flaw affects all versions up to and including 3.1.11 and stems from insufficient input sanitization and output escaping in the iq_tree_tree_chart_template widget setting. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The script executes in the browser of any user who accesses the injected page, including administrators. The vulnerability is classified under CWE-79.

Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, admin account takeover, and further WordPress compromise.

Affected Products

Graphina – Charts and Graphs For Elementor plugin for WordPress
All versions up to and including 3.1.11
WordPress sites running the Elementor page builder with Graphina installed

Discovery Timeline

2026-09-09 - CVE-2026-13709 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-13709

Vulnerability Analysis

The vulnerability resides in the Graphina Tree Chart widget, specifically in how the plugin handles the iq_tree_tree_chart_template setting supplied through the Elementor editor. The plugin accepts a user-controlled template string that is later rendered into the chart output without adequate sanitization or contextual output escaping. Because the payload is persisted in post meta as part of the Elementor widget configuration, execution occurs each time the page is rendered. Contributor-level users in WordPress can create and edit posts, which provides the authenticated privilege required to reach the vulnerable widget setting. The injected script runs in the origin of the WordPress site, giving the attacker access to cookies, the DOM, and any authenticated session context. Referenced source files include the widget control definition in includes/Charts/Elementor/GraphinaElementorControls.php, the helper logic in includes/GraphinaFunction.php, the template file templates/graphina-apex-tree/tree-chart.php, and the client-side rendering logic in assets/elementor/js/apex-tree/TreeChart.js.

Root Cause

The root cause is missing input sanitization when the iq_tree_tree_chart_template control value is saved, combined with missing output escaping when the value is written into the page markup and passed to the JavaScript rendering routine. WordPress functions such as wp_kses_post, esc_html, or esc_attr are not applied in the correct context, allowing HTML and <script> payloads to survive intact.

Attack Vector

An attacker authenticated as a contributor edits a post using Elementor, adds or modifies a Graphina Tree Chart widget, and places a JavaScript payload in the tree chart template field. Once the post is viewed by another user, the payload executes in that user's browser session. The scope change (S:C in the CVSS vector) reflects that scripts executed under the WordPress origin can act against components beyond the vulnerable widget itself, including the WordPress admin interface.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Change Set Record for technical details of the fix.

Detection Methods for CVE-2026-13709

Indicators of Compromise

Post meta entries under Elementor data containing iq_tree_tree_chart_template values with <script>, onerror=, onload=, or javascript: substrings.
Unexpected outbound requests from browsers viewing pages that embed a Graphina Tree Chart widget.
New administrator accounts or role changes shortly after a contributor edits a post containing a Graphina widget.
WordPress audit log entries showing contributor-level users repeatedly saving Graphina widget configurations.

Detection Strategies

Query the wp_postmeta table for _elementor_data rows containing the string iq_tree_tree_chart_template and inspect associated values for HTML or script tags.
Deploy a Web Application Firewall (WAF) rule that inspects Elementor save requests (/wp-admin/admin-ajax.php with action=elementor_ajax) for script payloads in Graphina widget fields.
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages that render Graphina charts.

Monitoring Recommendations

Enable WordPress activity logging for post edits by contributor and author roles, focusing on Elementor widget modifications.
Alert on privilege escalation events and unexpected creation of administrator accounts.
Review web server logs for anomalous requests originating from authenticated sessions immediately after page views of Graphina-enabled posts.

How to Mitigate CVE-2026-13709

Immediate Actions Required

Update the Graphina – Charts and Graphs For Elementor plugin to the version released after 3.1.11 that contains the fix referenced in the WordPress Change Set Record.
Audit all existing posts and pages that use the Graphina Tree Chart widget for suspicious template values.
Review contributor, author, and editor accounts for unexpected activity and rotate credentials where compromise is suspected.
Restrict who can install or edit Elementor widgets by tightening user role capabilities where feasible.

Patch Information

The vendor addressed the vulnerability in the release following version 3.1.11. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Consult the Wordfence Vulnerability Report for the fixed version identifier and additional remediation guidance.

Workarounds

Temporarily deactivate the Graphina – Charts and Graphs For Elementor plugin until the patched version is deployed.
Downgrade contributor and author accounts or require editor review before publishing content that uses Graphina widgets.
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering Elementor content.
Deploy WAF rules that block script tags and event handler attributes in elementor_ajax save requests targeting Graphina widget fields.

bash

# Update the plugin using WP-CLI once a patched version is available
wp plugin update graphina-elementor-charts-and-graphs

# Audit post meta for suspicious template values
wp db query "SELECT post_id, LEFT(meta_value, 200) FROM wp_postmeta \
  WHERE meta_key = '_elementor_data' \
  AND meta_value LIKE '%iq_tree_tree_chart_template%' \
  AND (meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%' OR meta_value LIKE '%javascript:%');"