CVE-2026-13709: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in iqonicdesign Graphina – Charts and Graphs For Elementor

CVE-2026-13709 is a stored cross-site scripting vulnerability in the Graphina – Charts and Graphs For Elementor WordPress plugin. The flaw exists in the 'iq_tree_tree_chart_template' widget setting due to inadequate sanitization and escaping of user input. Authenticated attackers with contributor-level or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the compromised pages. This vulnerability affects all versions up to and including 3.1.11. There is no vendor-provided patch or official remediation guidance available at this time.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the infected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the context of the victim's session. The CVSS score of 6.4 (medium severity) reflects the network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable widget setting to reduce risk.