CVE-2025-11820: 
WordPress vulnerability analysis and mitigation

CVE-2025-11820 is a Stored Cross-Site Scripting (XSS) vulnerability in the Graphina – Elementor Charts and Graphs plugin for WordPress, affecting all versions up to and including 3.1.8. The flaw stems from insufficient input sanitization and output escaping on data attributes across multiple chart widgets. It was discovered by researcher "webber-naut" (PoC created October 10, 2025) and published on November 5, 2025, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where JavaScript files for chart widgets — such as GraphinaApexChartBase.js, AdvanceDataTable.js, AreaChart.js, and LineChart.js — read values from HTML data attributes (data-chart_data and data-chart_options) without sanitizing them before rendering in the DOM. An authenticated attacker with Contributor-level access or above can embed malicious HTML/JavaScript payloads (e.g., <img src=x onerror=alert(1);>) within these data attributes using an HTML widget in Elementor, which are then stored and executed when any user views the affected page. The attack vector is network-based with low attack complexity and low privileges required. A public PoC demonstrating exploitation of the Advance Data Table and Area Chart widgets is available on GitHub (PoC Gist, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of any user — including administrators — who visit the compromised page. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and defacement. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and site visitors (Wordfence).

A public proof-of-concept exploit was created on October 10, 2025, and is available on GitHub, demonstrating exploitation of at least 10 affected chart widgets (PoC Gist). There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.036% (0.000360), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, limiting the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site running Graphina plugin version ≤ 3.1.8 with Elementor installed.
2. Create or edit a post in Elementor: As the Contributor, open the Elementor editor and add a new post or page.
3. Add a vulnerable chart widget: Insert one of the affected widgets (e.g., Area Chart, Advance Data Table) into the Elementor layout.
4. Craft the malicious payload: Using a tool like Burp Suite, intercept the Elementor save_builder POST request when saving the page. Modify the data-chart_data or data-chart_options attribute value to include an XSS payload, for example embedding <img src=x onerror=alert(1);> within the JSON structure of the data attribute.
5. Submit the request: Forward the modified request to save the page with the injected payload stored in the database.
6. Trigger execution: When any user (including an administrator) previews or visits the page containing the injected widget, the JavaScript in the unsanitized data attribute is executed in their browser, enabling session hijacking, credential theft, or further exploitation (PoC Gist, Wordfence).

• Logs: WordPress database or audit logs showing Elementor save_builder POST requests from Contributor-level accounts containing encoded HTML entities (e.g., <img, onerror=, <script) within data-chart_data or data-chart_options fields.
• File System / Database: Stored post content in the WordPress wp_posts table containing unsanitized HTML tags or JavaScript event handlers (e.g., onerror=, onload=, <script>) within Graphina widget data attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits containing Graphina chart widgets — indicative of XSS payload execution (e.g., cookie exfiltration via document.cookie).
• Browser/Application: Unexpected JavaScript alert dialogs, redirects, or form submissions on pages containing Graphina chart widgets, particularly Area Chart, Line Chart, or Advance Data Table widgets.

Users should update the Graphina – Elementor Charts and Graphs plugin to version 3.1.9 or later, which addresses the insufficient input sanitization and output escaping on data attributes. As an interim measure, site administrators can restrict Contributor-level user registration or remove the Contributor role's ability to publish/submit content until the patch is applied. Reviewing existing pages for suspicious content in Graphina widget data attributes is also recommended (Wordfence, Wordfence Weekly Report).

Wordfence reported this vulnerability as part of their weekly WordPress vulnerability report for November 3–9, 2025, noting the broad scope across at least 10 chart widget types (Wordfence Weekly Report). The vulnerability was also picked up by ENISA's European Vulnerability Database (EUVD-2025-37777) and INCIBE. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.