Threats tagged 'ghsa-h5w5-gj85-jwc6'

The Graphina – Charts and Graphs For Elementor WordPress plugin versions up to 3.1.13 are vulnerable to stored cross-site scripting (XSS) via the iq_tree_chart_node_font_family parameter and other text controls serialized into chart_data['settings']. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The plugin's reliance on Elementor's Utils::kses_post_deep() fails to remove the attack payload because it contains no disallowed HTML tags, only a single quote and an event-handler fragment, enabling persistence of the malicious code.