Stored Cross-Site Scripting Vulnerability in SQL Chart Builder Plugin for WordPress
CVE-2026-100158

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Sql Chart Builder
Vendor
CVE Published:
16 October 2026

What is CVE-2026-100158?

The SQL Chart Builder plugin for WordPress suffers from a Stored Cross-Site Scripting flaw due to inadequate input sanitization and output escaping. This vulnerability affects all versions up to and including 3.0.6, allowing authenticated users with subscriber-level access or higher to inject malicious web scripts into charts. When these charts are accessed by users, the injected scripts execute, potentially compromising user data. This exploit relies on an admin having published a chart linked to user-controllable SQL column values. Proper security measures and immediate updates are essential to safeguard against this vulnerability.

Affected Version(s)

SQL Chart Builder 0 <= 3.0.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/sql-chart-buil...
https://plugins.trac.wordpress.org/browser/sql-chart-buil...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

rwcpower100
.