CVE-2026-4079 - SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection

Back Back to CVE browser

MEDIUM

SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection

Published Apr 7, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

Affected products

Vendor n/a Product SQL Chart Builder Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.3.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

SQL Chart Builder

unaffected

Version	Status	Constraints
0	affected	<2.3.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (1)

https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Apr 7, 2026

Updated Apr 7, 2026

Reserved Mar 12, 2026

Link CVE-2026-4079

CISA Vulnrichment

Updated Apr 7, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-4079

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-4079