CVE-2026-4079

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.19% chance of exploitation in the next 30 days, 8th percentile

Published

2026-04-07

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/

References

• CVE Record
• NVD entry

Related

• CVE-2026-40776
• CVE-2026-40791
• CVE-2026-40775
• CVE-2026-40858
• CVE-2026-40701
• CVE-2026-40859