CVE-2025-2703: The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability

Description

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)16.0% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GR

Grafana · Grafana

11.6.0 before 11.6.0+security-01; 11.5.0 before 11.5.3+security-01; 11.4.0 before 11.4.3+security-01; 11.3.0 before 11.3.5+security-01; 11.2.0 before 11.2.8+security-01 · source: vendor