CVE-2026-4079

SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection

Medium · published April 7, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.3th percentile
Published
2026-04-07T06:00Z
EPSS history
Timeline
  • 07 APR 06:00Z
    SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection
    cvelistv5