CVE-2026-4079

Description

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

PUBLISHED Reserved 2026-03-12 | Published 2026-04-07 | Updated 2026-04-07 | Assigner WPScan

Problem types

CWE-89 SQL Injection

Product status

Credits

dangnosuy finder

WPScan coordinator

References

wpscan.com/...rability/8ec92881-4ae5-458d-995b-f097f2bcc590/ exploit vdb-entry technical-description

cve.org (CVE-2026-4079)

nvd.nist.gov (CVE-2026-4079)

Download JSON