Vulnerability · Published Apr 7, 2026 · Assigned by WPScan
CVE-2026-4079SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection
Medium 6.5
In plain English
A medium-severity security flaw in SQL Chart Builder from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 90.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | SQL Chart Builder | 0 – before 2.3.8 |
References
- https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/ exploit, vdb-entry, technical-description