CVE-2026-110291

Name of the Vulnerable Software and Affected Versions Graphina – Charts and Graphs For Elementor versions prior to 3.1.14

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue resides in the iq tree chart node font family parameter and any text control serialized into chart data['settings']. The vulnerability persists because the Utils::kses post deep() function fails to strip payloads containing only single quotes and event-handler fragments, as they do not contain disallowed HTML tags.

Recommendations Update Graphina – Charts and Graphs For Elementor to version 3.1.14 or later. Avoid using the iq tree chart node font family parameter until the update is applied.