CVE-2026-4079

SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

Affected

SQL Chart Builder

CVSS v3.1 CNA

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 20th percentile

Published

2026-04-07

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/

Security advisories

• https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590

References

• CVE Record
• NVD entry