Back to Database
Status published
Medium
CVE-2025-2703
The built-in XY Chart plugin is vulnerable to a DOM...
Vulnerability Description
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2703
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Paul Gerste (Sonar)
References
More from Grafana
View All →CVE-2025-8341
SSRF in Infinity Datasource Plugin
Medium
5
CVE-2025-6197
An open redirect vulnerability has been identified in Grafana OSS...
Medium
4.2
CVE-2025-6023
An open redirect vulnerability has been identified in Grafana OSS...
High
7.6
CVE-2025-4123
A cross-site scripting (XSS) vulnerability exists in Grafana caused by...
High
7.6
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Critical
9.1
Affected Vendor
Grafana
View all reports →Affected Software
Grafana, Grafana Enterprise
Vulnerable Versions:
11.6.0, 11.5.0, 11.4.0, 11.3.0, 11.2.0
Timeline
Official Publish:
April 23rd, 2025
Last Modified:
June 10th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L