CVE-2025-11820

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11820", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-15T17:23:50.590Z", "datePublished": "2025-11-05T09:27:38.778Z", "dateUpdated": "2026-04-08T16:34:38.928Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:38.928Z"}, "affected": [{"vendor": "iqonicdesign", "product": "Graphina \u2013 Charts and Graphs For Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Graphina \u2013 Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping on data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects multiple chart widgets including Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and Advance Data Table widgets."}], "title": "Graphina \u2013 Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a576c71-615c-4333-8cd3-93343ce64f7b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AdvanceDataTable.js"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/LineChart.js"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AreaChart.js"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/tags/3.1.7/assets/elementor/js/apex-chart/GraphinaApexChartBase.js#L303"}, {"url": "https://gist.github.com/webber-naut/3c26ce96cc18d3b8387edb8482653bc3"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-10-15T17:39:22.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T21:12:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T15:44:04.810070Z", "id": "CVE-2025-11820", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:44:24.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T15:44:04.810070Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:44:19.882Z"}}], "cna": {"title": "Graphina \u2013 Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "iqonicdesign", "product": "Graphina \u2013 Charts and Graphs For Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-15T17:39:22.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T21:12:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a576c71-615c-4333-8cd3-93343ce64f7b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AdvanceDataTable.js"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/LineChart.js"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AreaChart.js"}, {"url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/tags/3.1.7/assets/elementor/js/apex-chart/GraphinaApexChartBase.js#L303"}, {"url": "https://gist.github.com/webber-naut/3c26ce96cc18d3b8387edb8482653bc3"}], "descriptions": [{"lang": "en", "value": "The Graphina \u2013 Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping on data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects multiple chart widgets including Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and Advance Data Table widgets."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:38.928Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11820", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:38.928Z", "dateReserved": "2025-10-15T17:23:50.590Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T09:27:38.778Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Graphina \u2013 Charts and Graphs For Elementor", "vendor": "iqonicdesign", "versions": [{"lessThanOrEqual": "3.1.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Graphina \u2013 Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping on data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects multiple chart widgets including Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and Advance Data Table widgets."}, {"lang": "es", "value": "El plugin Graphina - Elementor Charts and Graphs para WordPress es vulnerable a Stored Cross-Site Scripting a trav\u00e9s de m\u00faltiples widgets de gr\u00e1ficos en todas las versiones hasta la 3.1.8, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos de datos. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. La vulnerabilidad afecta a m\u00faltiples widgets de gr\u00e1ficos, incluyendo Gr\u00e1fico de \u00c1rea, Gr\u00e1fico de L\u00edneas, Gr\u00e1fico de Columnas, Gr\u00e1fico de Donut, Gr\u00e1fico de Mapa de Calor, Gr\u00e1fico de Radar, Gr\u00e1fico Polar, Gr\u00e1fico Circular, Gr\u00e1fico Radial y widgets de Tabla de Datos Avanzada."}], "id": "CVE-2025-11820", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11820", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T15:44:04.810070Z", "version": "2.0.3"}}]}, "published": "2025-11-05T10:15:34.357", "references": [{"source": "security@wordfence.com", "url": "https://gist.github.com/webber-naut/3c26ce96cc18d3b8387edb8482653bc3"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/tags/3.1.7/assets/elementor/js/apex-chart/GraphinaApexChartBase.js#L303"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AdvanceDataTable.js"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/AreaChart.js"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/assets/elementor/js/apex-chart/LineChart.js"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a576c71-615c-4333-8cd3-93343ce64f7b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T22:57:09.415987+00:00", "value": {"mitigation_remediation": ["Update Graphina to version 3.1.9 or later to remove the CWE\u201179 vulnerability by fixing input sanitization and output escaping.", "If an update is not immediately possible, limit Contributor\u202f+ roles from editing chart widgets or switch the site to a more restrictive role model to reduce the available attack surface.", "Manually review and delete any chart widgets that contain injected scripts, and use a content sanitization plugin to escape any remaining data attributes before restoring the site."], "summary": {"action": "Apply Patch", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "Affected versions are all releases of the plugin up to and including 3.1.8. The problem exists in the Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart and Advance Data Table widgets, which are part of the iqonicdesign Graphina \u2013 Charts and Graphs For Elementor package installed on WordPress sites that use Elementor for page building.", "description_and_impact": "The Graphina \u2013 Elementor Charts and Graphs plugin for WordPress contains a stored cross\u2011site scripting flaw (CWE\u201179) that allows authenticated users with Contributor\u2011level or higher to inject arbitrary JavaScript into chart widget configuration data. Because the plugin fails to properly sanitize or escape data attributes, any script stored in a widget is executed whenever a user views a page containing that widget, resulting in a stored XSS vulnerability.", "risk_and_exploitability": "The CVSS score is 6.4, indicating a moderate exploitation risk. The EPSS score is less than 1%, suggesting that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Attacks require an authenticated Contributor\u2011level account and target sites where chart widgets are displayed to other users. Because the flaw is stored, compromised data remains on the site until the plugin is upgraded or the offending widget content is removed."}}}}, "created": "2025-11-06T10:07:17.791304+00:00", "updated": "2026-04-27T23:00:13.992511+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "iqonicdesign", "iqonicdesign$PRODUCT$graphina", "wordpress", "wordpress$PRODUCT$wordpress"]}